3.1

CVE-2022-30629

Exploit

Session tickets lack random ticket_age_add in crypto/tls

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Golang ≫ Go Version < 1.17.11
Golang ≫ Go Version >= 1.18.0 < 1.18.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.88% 0.543
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 3.1 1.6 1.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 3.1 1.6 1.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CWE-330 Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ
Vendor Advisory
Mailing List
https://go.dev/cl/405994
Patch
https://go.dev/issue/52814
Vendor Advisory
Exploit
Issue Tracking
https://go.googlesource.com/go/+/fe4de36198794c447fbd9d7cc2d7199a506c76a5
Patch
Mailing List
https://pkg.go.dev/vuln/GO-2022-0531
Vendor Advisory