wolfSSL Python Package Client Certificate Verification Vulnerability

A vulnerability exists in the wolfSSL Python package (wolfssl-py) in versions through 5.8.2, where the verify_mode set to CERT_REQUIRED does not properly enforce client certificate requirements. The absence of the WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT flag allows connections to be authenticated even when no client certificate is presented. This flaw enables attackers to bypass mutual TLS (mTLS) client authentication by omitting a certificate during the TLS handshake.

Impact

This vulnerability leads to improper authentication in mutual TLS (mTLS) client authentication, allowing connections to be established without a client certificate when one is required.

Reproduction

To reproduce this vulnerability, set the SSL context verify_mode to CERT_REQUIRED. When a connection is made without presenting a client certificate, the server will incorrectly authenticate the connection, demonstrating the flaw in verification.

Remediation

Users can upgrade to wolfSSL Python package version 5.8.4 or later, where this vulnerability has been fixed.