CVE-2022-30629

LOW3.1

Session tickets lack random ticket_age_add in crypto/tls

Published Aug 9, 2022

Modified 1 weeks ago

Details

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

References

WEB

https://go.dev/cl/405994

WEB

https://go.dev/issue/52814

WEB

https://go.googlesource.com/go/+/fe4de36198794c447fbd9d7cc2d7199a506c76a5

WEB

https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ

WEB

https://pkg.go.dev/vuln/GO-2022-0531

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2022-30629

CVSS Analysis

CVSS v3.1

3.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

NoneI:N

Availability

NoneA:N

3.1/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Ecosystems

Timeline

PublishedAug 9, 2022

ModifiedMar 6, 2026