CVE-2022-30629

Published: 10 August 2022

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

Priority

Cvss 3 Severity Score

3.1

Score breakdown

Status

Package	Release	Status
golang-1.17 Launchpad, Ubuntu, Debian	kinetic	Does not exist
	lunar	Does not exist
	upstream	Needs triage
	jammy	Needed
	impish	Ignored (end of life)
golang-1.18 Launchpad, Ubuntu, Debian	kinetic	Does not exist
	lunar	Does not exist
	upstream	Released (1.18.3-1)
	bionic	Released (1.18.1-1ubuntu1~18.04.4)
	focal	Released (1.18.1-1ubuntu1~20.04.2)
	jammy	Released (1.18.1-1ubuntu1.1)
golang-1.7 Launchpad, Ubuntu, Debian	upstream	Needs triage
golang-1.8 Launchpad, Ubuntu, Debian	bionic	Not vulnerable (code not present)
golang-1.8 Launchpad, Ubuntu, Debian	upstream	Needs triage
golang-1.15 Launchpad, Ubuntu, Debian	upstream	Needs triage
golang-1.15 Launchpad, Ubuntu, Debian	impish	Ignored (end of life)
golang-1.11 Launchpad, Ubuntu, Debian	upstream	Needs triage

Severity score breakdown

Parameter	Value
Base score	3.1
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	Low
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›