CVE-2022-25640: 
NixOS vulnerability analysis and mitigation

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. The vulnerability (CVE-2022-25640) allows a client to bypass authentication by simply omitting the certificate_verify message from the handshake (NVD).

The vulnerability affects the TLS 1.3 server implementation in wolfSSL, specifically related to the client certificate verification process. The issue stems from improper enforcement of mutual authentication requirements, where the server fails to properly validate the client's certificate verification message during the TLS handshake (WolfSSL Tracker).

When exploited, this vulnerability could allow unauthorized clients to establish connections to servers that require mutual authentication, effectively bypassing the security measure intended to ensure both parties are properly authenticated (NVD).

The vulnerability has been fixed in wolfSSL version 5.2.0 and later. Users are advised to upgrade to the latest version to address this security issue. Microsoft has also addressed this vulnerability in their Azure Sphere OS version 22.04 update (Microsoft Community).