Panic on large handshake records in crypto/tls (CVE-2022-41724)

Résumé

Panic on large handshake records in crypto/tls

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.6"},{"introduced":"1.20.0"},{"fixed":"1.20.1"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2022-41724 golang-1.15
Ubuntu UBUNTU-CVE-2022-41724 golang-1.18 Corrigé dans: 1.18.1-1ubuntu1~16.04.6+esm1

Références

advisory security.gentoo.org
advisory nvd.nist.gov
advisory github.com
web go.dev
web go.dev
web groups.google.com
web pkg.go.dev
web pkg.go.dev