GO-2022-0531
Session tickets lack random ticket_age_add in crypto/tls
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2022-30629
- Alias
- BIT-golang-2022-30629
Description
An attacker can correlate a resumed TLS session with a previous connection. Session tickets generated by crypto/tls do not contain a randomly generated ticket_age_add, which allows an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.17.11, introduced 1.18.0-0, fixed 1.18.3 |
Références
- https://go.dev/cl/405994 FIX
- https://go.googlesource.com/go/+/fe4de36198794c447fbd9d7cc2d7199a506c76a5 FIX
- https://go.dev/issue/52814 REPORT
- https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |