CVE-2022-41724
Large handshake records may cause panics in crypto/tls.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.11%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.11% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Affected
- golang/go
- Source
- security@golang.org
References
- https://go.dev/cl/468125Patch, Release Notes
- https://go.dev/issue/58001Issue Tracking, Patch, Vendor Advisory
- https://groups.google.com/g/golang-announce/c/V0aBFqaFs_EMailing List, Vendor Advisory
- https://pkg.go.dev/vuln/GO-2023-1570Vendor Advisory
- https://security.gentoo.org/glsa/202311-09
- https://go.dev/cl/468125Patch, Release Notes
- https://go.dev/issue/58001Issue Tracking, Patch, Vendor Advisory
- https://groups.google.com/g/golang-announce/c/V0aBFqaFs_EMailing List, Vendor Advisory
- https://pkg.go.dev/vuln/GO-2023-1570Vendor Advisory
- https://security.gentoo.org/glsa/202311-09
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.