PT-2023-29487 · Go+5 · Go+5
CVE-2023-45287
·
Publicado
2023-12-05
·
Atualizado
2026-02-18
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Go versions prior to 1.20
Description
The issue concerns the RSA-based TLS key exchanges in Go, which used the math/big library that is not constant time. Although RSA blinding was applied to prevent timing attacks, analysis suggests this may not have been fully effective, potentially leaking timing information due to the removal of PKCS#1 padding. This could be used to recover session key bits. The crypto/tls library in Go 1.20 has been updated to a fully constant time RSA implementation, believed to not exhibit any timing side channels.
Recommendations
For versions prior to 1.20, update to Go 1.20 or later to resolve the issue, as it includes a fully constant time RSA implementation. As a temporary workaround, consider restricting the use of RSA-based TLS key exchanges until a patch is available. Avoid relying on the math/big library for TLS key exchanges in affected versions.
Correção
Side Channel Attack
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Almalinux
Centos
Debian
Go
Red Hat
Rocky Linux