CVE-2022-30629

Session tickets lack random ticket_age_add in crypto/tls

Low · published August 9, 2022

CVSS v3.1
3.1
EPSS
1%
Percentile
66.4
In the wild
Unconfirmed
What it is

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01143 · 66.4th percentile
Published
2022-08-09T20:17Z
EPSS history
Timeline
  • 09 AUG 20:17Z
    Session tickets lack random ticket_age_add in crypto/tls
    cvelistv5