CVE-2022-41724

EUVD-2022-44896
Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 2%
Affected Products (NVD)
VendorProductVersion
golanggo
𝑥
< 1.19.6
golanggo
1.20.0
golanggo
1.20.0:rc1
golanggo
1.20.0:rc2
golanggo
1.20.0:rc3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
golang-1.15
bullseye
vulnerable
golang-1.19
bookworm
1.19.8-2
fixed
bullseye
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
golang
bionic
dne
focal
dne
jammy
dne
lunar
dne
mantic
dne
noble
dne
trusty
ignored
xenial
dne
golang-1.10
bionic
not-affected
focal
dne
jammy
dne
lunar
dne
mantic
dne
noble
dne
trusty
not-affected
xenial
not-affected
golang-1.13
bionic
needed
focal
needed
jammy
needed
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
needed
golang-1.14
bionic
dne
focal
needed
jammy
dne
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
dne
golang-1.16
bionic
needed
focal
needed
jammy
dne
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
dne
golang-1.17
bionic
dne
focal
dne
jammy
needed
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
dne
golang-1.18
bionic
needed
focal
needs-triage
jammy
needs-triage
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
needed
golang-1.19
bionic
dne
focal
dne
jammy
dne
kinetic
Fixed 1.19.2-1ubuntu1.1
released
lunar
not-affected
mantic
dne
noble
dne
trusty
ignored
xenial
ignored
golang-1.20
bionic
dne
focal
not-affected
jammy
not-affected
kinetic
dne
lunar
not-affected
mantic
not-affected
noble
dne
trusty
ignored
xenial
ignored
golang-1.21
bionic
dne
focal
not-affected
jammy
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
dne
xenial
dne
golang-1.6
bionic
dne
focal
dne
jammy
dne
lunar
dne
mantic
dne
noble
dne
trusty
ignored
xenial
not-affected
golang-1.8
bionic
not-affected
focal
dne
jammy
dne
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
dne
golang-1.9
bionic
not-affected
focal
dne
jammy
dne
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
dne