Read the docs
TI-2023-13789 Aliases CVE-2023-29409GHSA-xc82-5m89-g4jv

Large RSA keys can cause high CPU usage in crypto/tls

Priority LOW 27CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 23 fixed, 30 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01601 75th percentileScored 2026-11-07
Fix Partial crypto/tls (Go standard library): 1.19.12, 1.20.7, 1.21.0-rc.4Red Hat: 34 advisoriesRed Hat: 23 fixed, 30 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarycrypto/tlsbefore 1.19.12; 1.20.0-0 to before 1.20.7; 1.21.0-0 to before 1.21.0-rc.41.19.12, 1.20.7, 1.21.0-rc.4Patch availableCNA
  • crypto/tls VendorGo standard library Affected before 1.19.12; 1.20.0-0 to before 1.20.7; 1.21.0-0 to before 1.21.0-rc.4 Fixed in 1.19.12, 1.20.7, 1.21.0-rc.4 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.19.12; 1.20.0 to before 1.20.7VulnerableGo standard library
cpe:2.3:a:golang:go:1.21.0:rc1:*:*:*:*:*:*1.21.0 rc1VulnerableGo standard library
cpe:2.3:a:golang:go:1.21.0:rc2:*:*:*:*:*:*1.21.0 rc2VulnerableGo standard library
cpe:2.3:a:golang:go:1.21.0:rc3:*:*:*:*:*:*1.21.0 rc3VulnerableGo standard library
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.19.12; 1.20.0 to before 1.20.7 Vulnerable ·Go standard library
  • cpe:2.3:a:golang:go:1.21.0:rc1:*:*:*:*:*:* Versions 1.21.0 rc1 Vulnerable ·Go standard library
  • cpe:2.3:a:golang:go:1.21.0:rc2:*:*:*:*:*:* Versions 1.21.0 rc2 Vulnerable ·Go standard library
  • cpe:2.3:a:golang:go:1.21.0:rc3:*:*:*:*:*:* Versions 1.21.0 rc3 Vulnerable ·Go standard library

Remediation

  • Fix · CNA crypto/tls (Go standard library) Fixed in 1.19.12, 1.20.7, 1.21.0-rc.4

Red Hat 34 advisories

  • RHSA-2024:2988 Released 2024-05-22 · Red Hat rating Moderate
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x::container-tools:rhel8 +47
  • RHSA-2024:1383 Released 2024-03-19 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.15.0 security, enhancement, & bug fix update
    • RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +23
  • RHSA-2024:1027 Released 2024-02-28 · Red Hat rating Moderate
    Migration Toolkit for Applications security update
    • MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-pathfinder-rhel9 +3
Show 31 more Red Hat advisories
  • RHSA-2024:0292 Released 2024-01-23 · Red Hat rating Moderate
    OpenShift Container Platform 4.14.10 security update
    • Red Hat OpenShift Container Platform 4.14 microshift-4.14.10-202401181720.p0.gd25a4c5.assembly.4.14.10.el9, microshift-greenboot-4.14.10-202401181720.p0.gd25a4c5.assembly.4.14.10.el9, microshift-networking-4.14.10-202401181720.p0.gd25a4c5.assembly.4.14.10.el9 +2
  • RHSA-2024:0293 Released 2024-01-23 · Red Hat rating Moderate
    OpenShift Container Platform 4.14.10 packages and security update
    • Red Hat OpenShift Container Platform 4.14 openshift-4.14.0-202401121302.p0.ge36e183.assembly.stream.el8, openshift-4.14.0-202401121302.p0.ge36e183.assembly.stream.el9, openshift-hyperkube-4.14.0-202401121302.p0.ge36e183.assembly.stream.el8 +1
  • RHSA-2024:0121 Released 2024-01-10 · Red Hat rating Moderate
    container-tools:4.0 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.s390x::container-tools:4.0 +47
  • RHSA-2023:7762 Released 2023-12-12 · Red Hat rating Moderate
    skopeo security update
    • Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.13.3-3.el9_3, skopeo-tests-2:1.13.3-3.el9_3
  • RHSA-2023:7764 Released 2023-12-12 · Red Hat rating Moderate
    buildah security update
    • Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.31.3-2.el9_3, buildah-tests-1:1.31.3-2.el9_3
  • RHSA-2023:7766 Released 2023-12-12 · Red Hat rating Moderate
    containernetworking-plugins security update
    • Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.3.0-6.el9_3
  • RHSA-2023:7763 Released 2023-12-12 · Red Hat rating Moderate
    runc security update
    • Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.1.9-2.el9_3
  • RHSA-2023:7765 Released 2023-12-12 · Red Hat rating Moderate
    podman security update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.6.1-7.el9_3, podman-docker-2:4.6.1-7.el9_3, podman-gvproxy-2:4.6.1-7.el9_3 +3
  • RHSA-2023:6840 Released 2023-11-15 · Red Hat rating Important
    OpenShift Container Platform 4.14.2 packages and security update
    • Red Hat OpenShift Container Platform 4.14 cri-o-1.27.1-13.1.rhaos4.14.git956c5f7.el8, cri-o-1.27.1-13.1.rhaos4.14.git956c5f7.el9, openshift-clients-4.14.0-202311031050.p0.g9b1e0d2.assembly.stream.el8 +3
  • RHSA-2023:6279 Released 2023-11-15 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.11.5
    • Cert Manager support for Red Hat OpenShift release cert-manager/cert-manager-operator-rhel9, cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2023:6298 Released 2023-11-03 · Red Hat rating Important
    Release of OpenShift Serverless Client kn 1.30.2 security update
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.9.2-4.el8
  • RHSA-2023:6296 Released 2023-11-02 · Red Hat rating Important
    Release of OpenShift Serverless 1.30.2
    • Red Hat OpenShift Serverless 1.30 openshift-serverless-1-tech-preview/eventing-istio-controller-rhel8, openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8 +37
  • RHSA-2023:5009 Released 2023-10-31 · Red Hat rating Important
    OpenShift Container Platform 4.14.0 security update
    • Ironic content for Red Hat OpenShift Container Platform 4.14 openstack-ironic-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-api-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-common-1:21.5.0-0.20231002130534.0df5961.el9 +47
    • Red Hat OpenShift Container Platform 4.14 afterburn-5.4.3-1.rhaos4.14.el9, afterburn-dracut-5.4.3-1.rhaos4.14.el9, bpftool-7.0.0-284.36.1.el9_2 +47
  • RHSA-2023:6161 Released 2023-10-30 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.7.14 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8, rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8 +3
  • RHSA-2023:5933 Released 2023-10-26 · Red Hat rating Important
    Openshift Secondary Scheduler Operator 1.1.3 security update
    • OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
  • RHSA-2023:5947 Released 2023-10-26 · Red Hat rating Important
    Run Once Duration Override Operator for Red Hat OpenShift 1.0.1 security update
    • RODOO 1.0 for RHEL 8 run-once-duration-override-operator/run-once-duration-override-rhel8
  • RHSA-2023:6115 Released 2023-10-25 · Red Hat rating Important
    OpenShift API for Data Protection security update
    • 8Base-OADP-1.1 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-rhel8-operator, oadp/oadp-velero-plugin-for-aws-rhel8 +6
  • RHSA-2023:6085 Released 2023-10-24 · Red Hat rating Important
    Red Hat OpenShift distributed tracing security update
    • Red Hat OpenShift distributed tracing 2.9 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +15
  • RHSA-2023:6031 Released 2023-10-23 · Red Hat rating Important
    Cryostat security update
    • Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3
  • RHSA-2023:5976 Released 2023-10-20 · Red Hat rating Important
    Service Telemetry Framework 1.5.2 security update
    • Service Telemetry Framework 1.5 for RHEL 8 stf/prometheus-webhook-snmp-rhel8, stf/service-telemetry-operator-bundle, stf/service-telemetry-rhel8-operator +4
  • RHSA-2023:5974 Released 2023-10-20 · Red Hat rating Important
    Network Observability security update
    • NETOBSERV 1.4 for RHEL 9 network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9 +1
  • RHSA-2023:5971 Released 2023-10-20 · Red Hat rating Important
    Red Hat OpenStack Platform 17.1.1 (director-operator) security update
    • Red Hat OpenStack Platform 17.1 rhosp-rhel9/osp-director-agent, rhosp-rhel9/osp-director-downloader, rhosp-rhel9/osp-director-operator +1
  • RHSA-2023:5964 Released 2023-10-20 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2.5 (collectd-libpod-stats) security update
    • Red Hat OpenStack Platform 16.2 collectd-libpod-stats-1.0.4-5.el8ost
  • RHSA-2023:5965 Released 2023-10-20 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2.5 (collectd-libpod-stats, etcd) security update
    • Red Hat OpenStack Platform 16.2 etcd-3.3.23-15.el8ost, python-octavia-tests-tempest-1.4.1-2.20230111145026.f7718ef.el8ost, python3-octavia-tests-tempest-1.4.1-2.20230111145026.f7718ef.el8ost +1
  • RHSA-2023:5969 Released 2023-10-20 · Red Hat rating Important
    Red Hat OpenStack Platform 17.1.1 security update
    • Red Hat OpenStack Platform 17.1 collectd-libpod-stats-1.0.5-6.el9ost, etcd-3.4.26-3.el9ost, python-octavia-tests-tempest-1.9.0-1.20230509101018.el9ost +2
  • RHSA-2023:5530 Released 2023-10-20 · Red Hat rating Important
    Logging Subsystem 5.7.7 - Red Hat OpenShift security update
    • RHOL 5.7 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +7
  • RHSA-2023:5541 Released 2023-10-20 · Red Hat rating Important
    Logging Subsystem 5.6.12 - Red Hat OpenShift security update
    • RHOL 5.6 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +7
  • RHSA-2023:5935 Released 2023-10-19 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2.5 security update
    • Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent, rhosp-rhel8/osp-director-downloader, rhosp-rhel8/osp-director-operator +1
  • RHSA-2023:5805 Released 2023-10-17 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor-1.4.2-1.el8ap, receptorctl-1.4.2-1.el8ap
    • Red Hat Ansible Automation Platform 2.4 for RHEL 9 receptor-1.4.2-1.el9ap, receptorctl-1.4.2-1.el9ap
  • RHSA-2023:5738 Released 2023-10-16 · Red Hat rating Important
    go-toolset and golang security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) golang-1.19.13-1.el9_2, golang-bin-1.19.13-1.el9_2, golang-docs-1.19.13-1.el9_2 +4
  • RHSA-2023:5721 Released 2023-10-16 · Red Hat rating Important
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-1.module+el8.8.0+20380+7171fefb.aarch64::go-toolset:rhel8 +18

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Node Maintenance OperatorAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift Service Mesh 2AffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Security 4AffectedNo fix planned: Will not fix
Red Hat Application Interconnect 1.0AffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix planned: Out of support scope
Red Hat Certification for Red Hat Enterprise Linux 8AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Data Science (RHODS)AffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift distributed tracing 2AffectedNo fix yet
Red Hat OpenShift on AWSAffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 16.2AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 17.0AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 17.1AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 18.0AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Web TerminalAffectedNo fix yet: Fix deferred
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Self Node Remediation OperatorAffectedNo fix yet
mirror registry for Red Hat OpenShiftAffectedNo fix yet
8Base-MTV-2.4Fixed—
8Base-OADP-1.1Fixed RHSA-2023:6115
8Base-RHMTC-1.7Fixed RHSA-2023:6161
Cert Manager support for Red Hat OpenShift releaseFixed RHSA-2023:6279
Cryostat 2 on RHEL 8Fixed RHSA-2023:6031
LVMS 4.14 for RHEL 9Fixed—
MTA 6.2 for RHEL 8Fixed RHSA-2024:1027
NETOBSERV 1.4 for RHEL 9Fixed RHSA-2023:5974
OSSO 1.1 for RHEL 8Fixed RHSA-2023:5933
RHODF 4.15 for RHEL 9Fixed RHSA-2024:1383
RHOL 5.6 for RHEL 8Fixed RHSA-2023:5541
RHOL 5.7 for RHEL 8Fixed RHSA-2023:5530
RODOO 1.0 for RHEL 8Fixed RHSA-2023:5947
Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed RHSA-2023:5805
Red Hat Ansible Automation Platform 2.4 for RHEL 9Fixed RHSA-2023:5805
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:5721, RHSA-2024:0121, RHSA-2024:2988
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:5738, RHSA-2023:7762, RHSA-2023:7763, RHSA-2023:7764, RHSA-2023:7765, RHSA-2023:7766
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:5009, RHSA-2023:6840, RHSA-2024:0292, RHSA-2024:0293
Red Hat OpenShift Serverless 1.0Fixed RHSA-2023:6298
Red Hat OpenShift Serverless 1.30Fixed RHSA-2023:6296
Red Hat OpenStack Platform 16.2Fixed RHSA-2023:5935, RHSA-2023:5964, RHSA-2023:5965
Red Hat OpenStack Platform 17.1Fixed RHSA-2023:5969, RHSA-2023:5971
Service Telemetry Framework 1.5 for RHEL 8Fixed RHSA-2023:5976
Not affected: 21 products
  • 8Base-MTV-2.4
  • 8Base-OADP-1.1
  • 8Base-RHMTC-1.7
  • Cert Manager support for Red Hat OpenShift release
  • Cryostat 2 on RHEL 8
  • Ironic content for Red Hat OpenShift Container Platform 4.14
  • NETOBSERV 1.4 for RHEL 9
  • Node HealthCheck Operator
  • OSSO 1.1 for RHEL 8
  • RHODF 4.15 for RHEL 9
  • RHOL 5.6 for RHEL 8
  • RHOL 5.7 for RHEL 8
  • RODOO 1.0 for RHEL 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-29409
  2. 2026-10-03 Alias added: GHSA-xc82-5m89-g4jv

References

Patch 3

Advisory 1

Other 2

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences