CVE-2023-29409: Vulnerability in golang package - Large RSA Keys in Certificate Chains
Summary
CVE-2023-29409: Large RSA keys can cause high CPU usage in crypto/tls. Affects golang across 2 version ranges.
< 1.19.12
>= 1.20.0, < 1.20.7
Fixed in 1.19.12 or 1.20.7, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2023-29409 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The golang package is a popular open-source programming language that is widely used for building efficient and reliable software applications. It provides a rich set of libraries and tools for various purposes, including cryptography and secure communication. However, a vulnerability has been identified in the package related to the handling of extremely large RSA keys in certificate chains.
Vulnerability Detail
The vulnerability arises when a client/server encounters certificate chains with RSA keys larger than 8192 bits. This can lead to significant CPU usage during signature verification, potentially causing performance degradation and denial of service. While there are currently only three known certificates with larger keys, which are likely test certificates, it is possible that larger keys exist in private PKIs. To enhance the default safety of users, the golang package now restricts the size of RSA keys transmitted during handshakes to <= 8192 bits.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.19.121.19.12 -
>= 1.20.0, < 1.20.71.20.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they are using the latest version of the golang package, which includes the fix for the restricted size of RSA keys.
Conclusion
In conclusion, the golang package is vulnerable to a potential performance degradation and denial of service issue caused by the handling of extremely large RSA keys in certificate chains. Users are advised to update to the latest version of the package to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for golang →
FAQ
The vulnerability can cause significant CPU usage during signature verification, potentially leading to performance degradation and denial of service.
There are currently only three known certificates with larger keys, but they are likely test certificates and not actively deployed.
It is possible that larger keys exist in private PKIs, but the focus of this vulnerability is on the web PKI.
The severity of this vulnerability is classified as Medium.
For more information, you can refer to the source link provided in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
