Panic on large handshake records in crypto/tls(CVE-2022-41724)

概要

Panic on large handshake records in crypto/tls

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.6"},{"introduced":"1.20.0"},{"fixed":"1.20.1"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2022-41724 golang-1.15
Ubuntu UBUNTU-CVE-2022-41724 golang-1.18 修正版: 1.18.1-1ubuntu1~16.04.6+esm1

参照URL

advisory go.dev
advisory groups.google.com
advisory pkg.go.dev
patch go.dev
web security.gentoo.org
web nvd.nist.gov