Alerts This Week
Warning Icon 1 483
Alerts This Week
Warning Icon 1 483

Mageia 8: 2022-0231 Critical Advisory on Golang TLS Session Handling Issue

mageia
Calendar Grey June 16, 2022
Dist Mageia Esm H88
Mageia 8 has released updated golang packages to fix a serious vulnerability in session ticket management. Stay protected!
crypto/tls: session tickets lack random ticket_age_add

Summary

crypto/tls: session tickets lack random ticket_age_add. Session tickets generated by crypto/tls did not contain a randomly generated ticket_age_add. This allows an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption. (CVE-2022-30629)

References

- https://bugs.mageia.org/show_bug.cgi?id=30530

- https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg

-

- https://www.cve.org/CVERecord?id=CVE-2022-30629

Topics%20covered

Topics Covered

security advisory network security critical session handling golang mageia

Resolution

SRPMS

- 8/core/golang-1.17.11-1.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 16 Jun 2022
URL: https://advisories.mageia.org/MGASA-2022-0231.html
Type: security
CVE: CVE-2022-30629

Topics%20covered

Topics Covered

security advisory network security critical session handling golang mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here