CVE-2022-41724: Vulnerability in stdlib package - Large handshake records may cause panics
Summary
CVE-2022-41724: Large handshake records may cause panics in crypto/tls. Affects golang-1.15 versions < 8656c03fee94ce9cdc4da120b831c2fb9fd68d9d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package is a part of the Go programming language standard library. It provides a collection of essential packages and modules for various functionalities in Go applications. The package is widely used and trusted by developers for its reliability and performance. However, a vulnerability has been discovered in the stdlib package that can lead to panics when handling large TLS handshake records.
Vulnerability Detail
The vulnerability arises from the handling of large TLS handshake records in the crypto/tls module of the stdlib package. Both clients and servers can trigger this issue by sending oversized handshake records. This can cause servers and clients to panic while constructing responses. The vulnerability affects all TLS 1.3 clients, TLS 1.2 clients with session resumption enabled, and TLS 1.3 servers requesting client certificates. The impact of this vulnerability can range from service disruption to potential remote code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, developers can consider implementing rate limiting or size restrictions on incoming TLS handshake records. By enforcing limits on the size of handshake records, the risk of triggering the vulnerability can be mitigated. Here's an example of how to implement size restrictions in a Go application:
// Set a maximum size for TLS handshake records
config.MaxHandshakeRecordSize = 4096
Conclusion
The vulnerability in the stdlib package can lead to panics when handling large TLS handshake records. It is crucial for developers to update to the fixed versions (1.19.6 or 1.20.1) to prevent potential service disruptions and remote code execution. Implementing size restrictions or rate limiting can provide temporary mitigation until the update is applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability can lead to panics in the stdlib package when handling large TLS handshake records. This can result in service disruptions and potentially allow attackers to execute arbitrary code.
The vulnerability affects stdlib package version 1.18.2. Prior versions may also be affected.
The vulnerability affects all TLS 1.3 clients, TLS 1.2 clients with session resumption enabled, and TLS 1.3 servers requesting client certificates.
Yes, the vulnerability has been fixed in stdlib package versions 1.19.6 and 1.20.1. It is recommended to update to one of these versions to mitigate the risk.
To protect your application, ensure that you are using a fixed version of the stdlib package (1.19.6 or 1.20.1). Additionally, consider implementing rate limiting or size restrictions on incoming TLS handshake records as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
