CVE-2022-41724

Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GoCNA
---
---
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 2%
VendorProductVersion
golanggo
𝑥
< 1.19.6
golanggo
1.20.0
golanggo
1.20.0:rc1
golanggo
1.20.0:rc2
golanggo
1.20.0:rc3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
golang-1.15
bullseye
vulnerable
golang-1.19
bookworm
1.19.8-2
fixed
bullseye
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
golang
noble
dne
mantic
dne
lunar
dne
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
ignored
golang-1.10
noble
dne
mantic
dne
lunar
dne
jammy
dne
focal
dne
bionic
not-affected
xenial
not-affected
trusty
not-affected
golang-1.13
noble
dne
mantic
dne
lunar
dne
jammy
needed
focal
needed
bionic
needed
xenial
needed
trusty
dne
golang-1.14
noble
dne
mantic
dne
lunar
dne
jammy
dne
focal
needed
bionic
dne
xenial
dne
trusty
dne
golang-1.16
noble
dne
mantic
dne
lunar
dne
jammy
dne
focal
needed
bionic
needed
xenial
dne
trusty
dne
golang-1.17
noble
dne
mantic
dne
lunar
dne
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
golang-1.18
noble
dne
mantic
dne
lunar
dne
jammy
needs-triage
focal
needs-triage
bionic
needed
xenial
needed
trusty
dne
golang-1.19
noble
dne
mantic
dne
lunar
not-affected
kinetic
Fixed 1.19.2-1ubuntu1.1
released
jammy
dne
focal
dne
bionic
dne
xenial
ignored
trusty
ignored
golang-1.20
noble
dne
mantic
not-affected
lunar
not-affected
kinetic
dne
jammy
not-affected
focal
not-affected
bionic
dne
xenial
ignored
trusty
ignored
golang-1.21
noble
not-affected
mantic
not-affected
lunar
not-affected
jammy
not-affected
focal
not-affected
bionic
dne
xenial
dne
trusty
dne
golang-1.6
noble
dne
mantic
dne
lunar
dne
jammy
dne
focal
dne
bionic
dne
xenial
not-affected
trusty
ignored
golang-1.8
noble
dne
mantic
dne
lunar
dne
jammy
dne
focal
dne
bionic
not-affected
xenial
dne
trusty
dne
golang-1.9
noble
dne
mantic
dne
lunar
dne
jammy
dne
focal
dne
bionic
not-affected
xenial
dne
trusty
dne