Lucene search
+L

CVE-2022-30629 Session tickets lack random ticket_age_add in crypto/tls

🗓️ 09 Aug 2022 20:17:31Reported by GoType 
cvelist
 cvelist
🔗 www.cve.org👁 26 Views

Session tickets lack random ticket_age_add in crypto/tls. Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker to correlate successive connections by comparing ticket ages during session resumption

Related
Affected
Refs
ReporterTitlePublishedViews
Family
Oracle linux
go-toolset:ol8addon security update
12 Jul 202200:00
oraclelinux
Oracle linux
buildah security and bug fix update
15 May 202300:00
oraclelinux
Oracle linux
podman security and bug fix update
15 May 202300:00
oraclelinux
Oracle linux
skopeo security and bug fix update
15 May 202300:00
oraclelinux
Oracle linux
containernetworking-plugins security and bug fix update
15 May 202300:00
oraclelinux
Oracle linux
container-tools:ol8 security, bug fix, and enhancement update
23 May 202300:00
oraclelinux
Oracle linux
podman security, bug fix, and enhancement update
11 Nov 202300:00
oraclelinux
Oracle linux
podman security update
3 May 202400:00
oraclelinux
Oracle linux
podman security update
14 Nov 202400:00
oraclelinux
OpenVAS
Fedora: Security Advisory for assetfinder (FEDORA-2022-fae3ecee19)
6 Jul 202200:00
openvas
Rows per page
[
  {
    "vendor": "Go standard library",
    "product": "crypto/tls",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "crypto/tls",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.17.11",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.18.0-0",
        "lessThan": "1.18.3",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "serverHandshakeStateTLS13.sendSessionTickets"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

12 Jun 2023 19:04Current
7.4High risk
Vulners AI Score7.4
EPSS0.00898
26