Session tickets lack random ticket_age_add in crypto/tls
Priority LOW 18CWE-330Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 17 fixed, 30 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0121 68th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial crypto/tls (Go standard library): 1.17.11, 1.18.3Red Hat: 32 advisoriesRed Hat: 17 fixed, 30 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | crypto/tls | before 1.17.11; 1.18.0-0 to before 1.18.3 | 1.17.11, 1.18.3 | Patch available | CNA |
- crypto/tls VendorGo standard library Affected before 1.17.11; 1.18.0-0 to before 1.18.3 Fixed in 1.17.11, 1.18.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.17.11; 1.18.0 to before 1.18.3 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.17.11; 1.18.0 to before 1.18.3 Vulnerable ·Go standard library
Remediation
- Fix · CNA crypto/tls (Go standard library) Fixed in 1.17.11, 1.18.3
Red Hat 32 advisories
- RHSA-2023:4488 Released 2023-08-07 · Red Hat rating ModerateRed Hat OpenShift support for Windows Containers 6.0.1[security update]
- Red Hat OpenShift Container Platform 4.11 openshift4-wincw/windows-machine-config-rhel8-operator
- RHSA-2023:3914 Released 2023-07-06 · Red Hat rating ImportantRed Hat OpenShift Enterprise security update
- Red Hat OpenShift Container Platform 4.11 buildah-1:1.23.4-3.rhaos4.11.el8, buildah-tests-1:1.23.4-3.rhaos4.11.el8, openshift-4.11.0-202306260054.p0.g990d55b.assembly.stream.el8 +12
- RHSA-2023:3642 Released 2023-06-15 · Red Hat rating ImportantRed Hat Ceph Storage 6.1 Container security and bug fix update
- Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
Show 29 more Red Hat advisories
- RHSA-2023:2758 Released 2023-05-16 · Red Hat rating Moderatecontainer-tools:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.s390x::container-tools:rhel8 +47
- RHSA-2023:2283 Released 2023-05-09 · Red Hat rating Moderateskopeo security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.11.2-0.1.el9, skopeo-tests-2:1.11.2-0.1.el9
- RHSA-2023:2282 Released 2023-05-09 · Red Hat rating Moderatepodman security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.4.1-3.el9, podman-docker-2:4.4.1-3.el9, podman-gvproxy-2:4.4.1-3.el9 +3
- RHSA-2023:2253 Released 2023-05-09 · Red Hat rating Moderatebuildah security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.29.1-1.el9, buildah-tests-1:1.29.1-1.el9
- RHSA-2023:2367 Released 2023-05-09 · Red Hat rating Moderatecontainernetworking-plugins security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.2.0-1.el9
- RHSA-2023:1529 Released 2023-03-30 · Red Hat rating ModerateService Telemetry Framework 1.5 security update
- Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8
- RHSA-2023:1275 Released 2023-03-15 · Red Hat rating ImportantRed Hat OpenStack Platform (etcd) security update
- Red Hat OpenStack Platform 16.1 etcd-3.3.23-12.el8ost
- Red Hat OpenStack Platform 16.2 etcd-3.3.23-12.el8ost
- RHSA-2023:0408 Released 2023-01-25 · Red Hat rating ImportantOpenShift Virtualization 4.12.0 Images security update
- CNV 4.12 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-provisioner-rhel8, container-native-virtualization/hostpath-provisioner-rhel8-operator +9
- RHSA-2023:0407 Released 2023-01-24 · Red Hat rating ModerateOpenShift Virtualization 4.12.0 RPMs security update
- CNV 4.12 for RHEL 7 kubevirt-4.12.0-1057.el7, kubevirt-virtctl-4.12.0-1057.el7, kubevirt-virtctl-redistributable-4.12.0-1057.el7
- CNV 4.12 for RHEL 8 kubevirt-4.12.0-1057.el8, kubevirt-virtctl-4.12.0-1057.el8, kubevirt-virtctl-redistributable-4.12.0-1057.el8
- RHSA-2022:9047 Released 2022-12-15 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.6 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-hook-runner-rhel8, rhmtc/openshift-migration-legacy-rhel8-operator +14
- RHSA-2022:8750 Released 2022-12-01 · Red Hat rating ModerateOpenShift Virtualization 4.11.1 security and bug fix update
- CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
- RHSA-2022:6696 Released 2022-09-26 · Red Hat rating CriticalRed Hat Advanced Cluster Management 2.4.6 security update and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
- RHSA-2022:6535 Released 2022-09-20 · Red Hat rating LowOpenShift Container Platform 4.11.5 packages and security update
- Red Hat OpenShift Container Platform 4.11 cri-tools-1.24.2-6.el8
- RHSA-2022:6430 Released 2022-09-13 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.0.4 security and bug fix update
- 8Base-OADP-1.0 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-mustgather-rhel8, oadp/oadp-operator-bundle +9
- RHSA-2022:6370 Released 2022-09-06 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.6.0 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8 +45
- RHSA-2022:6345 Released 2022-09-06 · Red Hat rating ModerateMulticluster Engine for Kubernetes 2.1 security updates and bug fixes
- multicluster engine for Kubernetes 2.1 for RHEL 8 multicluster-engine/agent-service-rhel8, multicluster-engine/apiserver-network-proxy-rhel8, multicluster-engine/assisted-image-service-rhel8 +37
- RHSA-2022:6347 Released 2022-09-06 · Red Hat rating ModerateVolSync 0.5 security fixes and updates
- Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/volsync-mover-rclone-rhel8, rhacm2/volsync-mover-restic-rhel8, rhacm2/volsync-mover-rsync-rhel8 +3
- RHSA-2022:6348 Released 2022-09-06 · Red Hat rating ModerateGatekeeper Operator v0.2 security and container updates
- Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/gatekeeper-operator-bundle, rhacm2/gatekeeper-rhel8, rhacm2/gatekeeper-rhel8-operator
- RHSA-2022:6346 Released 2022-09-06 · Red Hat rating ModerateRHSA: Submariner 0.13 - security and enhancement update
- Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/lighthouse-agent-rhel8, rhacm2/lighthouse-coredns-rhel8, rhacm2/nettest-rhel8 +7
- RHSA-2022:6152 Released 2022-09-01 · Red Hat rating ImportantSecondary Scheduler Operator for Red Hat OpenShift 1.1.0 security update
- OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
- RHSA-2022:6290 Released 2022-09-01 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.1.0 security and bug fix update
- 8Base-OADP-1.1 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-mustgather-rhel8, oadp/oadp-rhel8-operator +8
- RHSA-2022:6277 Released 2022-08-31 · Red Hat rating ModerateRed Hat OpenShift Service Mesh 2.1.5 security update
- OpenShift Service Mesh 2.1 servicemesh-2.1.5-1.el8, servicemesh-cni-2.1.5-1.el8, servicemesh-operator-2.1.5-1.el8 +6
- RHSA-2022:6103 Released 2022-08-23 · Red Hat rating ModerateOpenShift Container Platform 4.11.1 bug fix and security update
- Red Hat OpenShift Container Platform 4.11 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
- RHSA-2022:6102 Released 2022-08-23 · Red Hat rating LowOpenShift Container Platform 4.11.1 packages and security update
- Red Hat OpenShift Container Platform 4.11 butane-0.15.0-2.rhaos4.11.el8, butane-redistributable-0.15.0-2.rhaos4.11.el8, cri-o-1.24.2-4.rhaos4.11.gitd6283df.el8 +2
- RHSA-2022:6040 Released 2022-08-10 · Red Hat rating ImportantRelease of OpenShift Serverless 1.24.0
- Red Hat OpenShift Serverless 1.24 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +35
- RHSA-2022:6042 Released 2022-08-10 · Red Hat rating ImportantRelease of OpenShift Serverless Client kn 1.24.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.3.1-4.el8
- RHSA-2022:5866 Released 2022-08-02 · Red Hat rating Importantgo-toolset-1.17 and go-toolset-1.17-golang security and bug fix update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.17-1.17.12-1.el7_9, go-toolset-1.17-build-1.17.12-1.el7_9, go-toolset-1.17-golang-1.17.12-1.el7_9 +8
- RHSA-2022:5799 Released 2022-08-01 · Red Hat rating Importantgo-toolset and golang security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.17.12-1.el9_0, golang-1.17.12-1.el9_0, golang-bin-1.17.12-1.el9_0 +5
- RHSA-2022:5775 Released 2022-08-01 · Red Hat rating Importantgo-toolset:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.12-1.module+el8.6.0+16014+a372c00b.aarch64::go-toolset:rhel8 +18
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| OpenShift Service Mesh 2.1 | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Software Collections | Affected | No fix yet: Fix deferred |
| Red Hat Web Terminal | Affected | No fix yet |
| Service Telemetry Framework 1.3 for RHEL 8 | Affected | No fix yet: Fix deferred |
| Service Telemetry Framework 1.4 for RHEL 8 | Affected | No fix yet: Fix deferred |
| mirror registry for Red Hat OpenShift | Affected | No fix yet |
| 8Base-OADP-1.0 | Fixed | RHSA-2022:6430 |
| 8Base-OADP-1.1 | Fixed | RHSA-2022:6290 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2022:9047 |
| CNV 4.12 for RHEL 7 | Fixed | RHSA-2023:0407 |
| CNV 4.12 for RHEL 8 | Fixed | RHSA-2023:0407, RHSA-2023:0408 |
| OSSO 1.1 for RHEL 8 | Fixed | RHSA-2022:6152 |
| OpenShift Service Mesh 2.1 | Fixed | RHSA-2022:6277 |
| Red Hat Ceph Storage 6.1 Tools | Fixed | RHSA-2023:3642 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2022:5866 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:5775, RHSA-2023:2758 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:5799, RHSA-2023:2253, RHSA-2023:2282, RHSA-2023:2283, RHSA-2023:2367 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2022:6102, RHSA-2022:6103, RHSA-2022:6535, RHSA-2023:3914, RHSA-2023:4488 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2022:6042 |
| Red Hat OpenShift Serverless 1.24 | Fixed | RHSA-2022:6040 |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2023:1275 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2023:1275 |
| Service Telemetry Framework 1.5 for RHEL 8 | Fixed | RHSA-2023:1529 |
Not affected: 13 products
- 8Base-OADP-1.1
- 8Base-RHMTC-1.7
- CNV 4.12 for RHEL 8
- Ironic content for Red Hat OpenShift Container Platform 4.11
- OSSO 1.1 for RHEL 8
- Red Hat Ceph Storage 6.1 Tools
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift distributed tracing 2
- Red Hat OpenStack Platform 16.2
- Red Hat Openshift Data Foundation 4
- Service Telemetry Framework 1.5 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2022-30629
- 2026-10-03 Alias added: GHSA-j55j-52j7-vq87
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-30629 · CVE Program
- CVE-2022-30629 · NVD
- FIRST EPSS
- GHSA-j55j-52j7-vq87 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-30629 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences