wolfSSL TLS 1.3 HelloRetryRequest Handshake Confidentiality Vulnerability

A vulnerability in wolfSSL's TLS 1.3 client HelloRetryRequest handshake logic could compromise the confidentiality of TLS-protected communications. This issue arises from a missing cryptographic step that allows a crafted HelloRetryRequest, followed by a ServerHello message that omits the necessary key_share extension, to be exploited. As a result, predictable traffic secrets can be derived from the (EC)DHE shared secret. However, this vulnerability does not impact the client's authentication of the server during TLS handshakes.

Impact

Exploitation of this vulnerability could lead to the derivation of predictable traffic secrets, allowing for a compromise of the confidentiality of TLS-protected communications.