Panic on large handshake records in crypto/tls (CVE-2022-41724)

Summary

Panic on large handshake records in crypto/tls

Original description

The description as published by the source.

Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.6"},{"introduced":"1.20.0"},{"fixed":"1.20.1"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2022-41724 golang-1.15
Ubuntu UBUNTU-CVE-2022-41724 golang-1.18 Fixed in: 1.18.1-1ubuntu1~16.04.6+esm1

References

advisory security.gentoo.org
advisory nvd.nist.gov
advisory github.com
web go.dev
web go.dev
web groups.google.com
web pkg.go.dev
web pkg.go.dev