golang: crypto/tls: large handshake records may cause panics

🗓️ 23 Jun 2023 04:43:23Reported by RedHatType

Golang crypto/tls vulnerability allows denial of service via large TLS handshake records by a remote authenticated attacker.

Reporter	Title	Published	Views	Family All 389
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-41724)	27 Jul 202317:38	–	ibm
IBM Security Bulletins	Security Bulletin: Mutiple Vulnerabilties affects IBM Watson Machine Learning Accelerator 3.5.0 for Cloud Pak for Data 4.6.5	8 Feb 202419:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data Scheduling is vulnerable to multiple ansible-operator and opm vulnerabilities	20 Feb 202419:29	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Go	3 Apr 202313:25	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Pypa Setuptools, Golang Go, OpenSSH, Minio and Certifi may affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift	26 Mar 202503:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands and operator may be vulnerable to denial of service due to [CVE-2022-41724]	28 Apr 202311:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is affected by multiple vulnerabilities in Golang Go	5 Jul 202321:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in golang affect IBM Db2® REST	1 May 202314:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to several issues due to go modules used in nginx ( CVE-2023-24532, CVE-2022-41724, CVE-2022-41725, CVE-2022-41723 )	8 Aug 202415:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by vulnerabilities in Golang Go (CVE-2022-41724, CVE-2023-24532)	17 May 202311:09	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	aarch64	conmon	3:2.1.7-2.rhaos4.13.el8	conmon-3:2.1.7-2.rhaos4.13.el8.aarch64.rpm
Red Hat Enterprise Linux	8	ppc64le	conmon	3:2.1.7-2.rhaos4.13.el8	conmon-3:2.1.7-2.rhaos4.13.el8.ppc64le.rpm
Red Hat Enterprise Linux	8	s390x	conmon	3:2.1.7-2.rhaos4.13.el8	conmon-3:2.1.7-2.rhaos4.13.el8.s390x.rpm
Red Hat Enterprise Linux	8	x86_64	conmon	3:2.1.7-2.rhaos4.13.el8	conmon-3:2.1.7-2.rhaos4.13.el8.x86_64.rpm
Red Hat Enterprise Linux	9	aarch64	conmon	3:2.1.7-2.1.rhaos4.13.el9	conmon-3:2.1.7-2.1.rhaos4.13.el9.aarch64.rpm
Red Hat Enterprise Linux	9	ppc64le	conmon	3:2.1.7-2.1.rhaos4.13.el9	conmon-3:2.1.7-2.1.rhaos4.13.el9.ppc64le.rpm
Red Hat Enterprise Linux	9	s390x	conmon	3:2.1.7-2.1.rhaos4.13.el9	conmon-3:2.1.7-2.1.rhaos4.13.el9.s390x.rpm
Red Hat Enterprise Linux	9	x86_64	conmon	3:2.1.7-2.1.rhaos4.13.el9	conmon-3:2.1.7-2.1.rhaos4.13.el9.x86_64.rpm
Red Hat Enterprise Linux	8	aarch64	conmon-debuginfo	3:2.1.7-2.rhaos4.13.el8	conmon-debuginfo-3:2.1.7-2.rhaos4.13.el8.aarch64.rpm
Red Hat Enterprise Linux	8	ppc64le	conmon-debuginfo	3:2.1.7-2.rhaos4.13.el8	conmon-debuginfo-3:2.1.7-2.rhaos4.13.el8.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2022-41724
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/468125
go	www.go.dev/issue/58001
groups	www.groups.google.com/g/golang-announce/c/V0aBFqaFs_E
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-41724
pkg	www.pkg.go.dev/vuln/GO-2023-1570
cve	www.cve.org/CVERecord

17 Jul 2026 16:30Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.17.5

EPSS0.01111

SSVC

CWE-400