CVE-2022-30629: Non-random values for ticket_age_add in session tickets in crypto/tls
Summary
CVE-2022-30629: Session tickets lack random ticket_age_add in crypto/tls. Affects golang across 2 version ranges.
< 1.17.11
>= 1.18.0, < 1.18.3
Fixed in 1.17.11 or 1.18.3, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2022-30629 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package is a popular open-source programming language that provides a robust development environment for building efficient and scalable applications. It is widely used for various purposes, including web development, network programming, and system administration. However, a vulnerability has been discovered in the crypto/tls module of the golang package, which can allow an attacker to correlate successive connections by comparing ticket ages during session resumption.
Vulnerability Detail
The vulnerability arises from the use of non-random values for ticket_age_add in session tickets. This can be exploited by an attacker who can observe TLS handshakes to track and correlate connections. By analyzing the ticket ages during session resumption, the attacker can gain insights into the activities and patterns of users, potentially compromising their privacy and security. Although the severity of this vulnerability is low, it is still important to address it to prevent any potential misuse of the information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.17.111.17.11 -
>= 1.18.0, < 1.18.31.18.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the golang package to the fixed versions.
Conclusion
In conclusion, the golang package is vulnerable to a low-severity issue related to non-random values for ticket_age_add in session tickets. While the impact of this vulnerability is relatively low, it is still important to update the package to the fixed versions (1.17.11 or 1.18.3) to prevent any potential misuse of user information. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for golang →
FAQ
The impact of this vulnerability is relatively low. However, it can potentially compromise the privacy and security of users by allowing an attacker to correlate their connections and gain insights into their activities.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
There is no known exploit for this vulnerability at the moment. However, it is still important to address it by updating the golang package to the fixed versions.
The recommended approach is to update the golang package to the fixed versions. There is no specific mitigation mentioned for this vulnerability.
You can find more information about this vulnerability in the official CVE entry (CVE-2022-30629) or the Bitnami vulnerability database (https://github.com/bitnami/vulndb/tree/main/data/golang/BIT-golang-2022-30629.json).
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
