Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel
Priority LOW 35CWE-203Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 12 fixed, 28 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-203.
Summary
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels.
Why it matters now
EPSS 0.0125 69th percentileScored 2026-11-07
Fix Partial crypto/tls (Go standard library): 1.20.0Red Hat: 19 advisoriesRed Hat: 12 fixed, 28 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | crypto/tls | before 1.20.0 | 1.20.0 | Patch available | CNA |
- crypto/tls VendorGo standard library Affected before 1.20.0 Fixed in 1.20.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.20.0 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.20.0 Vulnerable ·Go standard library
Remediation
- Fix · CNA crypto/tls (Go standard library) Fixed in 1.20.0
Red Hat 19 advisories
- RHSA-2024:4429 Released 2024-07-09 · Red Hat rating Moderatecontainernetworking-plugins security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) containernetworking-plugins-1:1.2.0-3.el9_2
- RHSA-2024:3316 Released 2024-05-23 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 7.0 for RHEL 9 mta/mta-analyzer-addon-rhel9, mta/mta-analyzer-lsp-rhel9, mta/mta-cli-rhel9 +3
- RHSA-2024:2730 Released 2024-05-22 · Red Hat rating ImportantRed Hat OpenStack Platform 17.1 (collectd-sensubility) security update
- Red Hat OpenStack Platform 17.1 collectd-sensubility-0.2.1-3.el9ost
Show 16 more Red Hat advisories
- RHSA-2024:2729 Released 2024-05-22 · Red Hat rating ImportantRed Hat OpenStack Platform 17.1 (etcd) security update
- Red Hat OpenStack Platform 17.1 etcd-3.4.26-8.el9ost
- RHSA-2024:2767 Released 2024-05-22 · Red Hat rating ImportantRed Hat OpenStack Platform 17.1 (collectd-sensubility) security update
- Red Hat OpenStack Platform 17.1 collectd-sensubility-0.2.1-3.el8ost
- RHSA-2024:2988 Released 2024-05-22 · Red Hat rating Moderatecontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x::container-tools:rhel8 +47
- RHSA-2024:2180 Released 2024-04-30 · Red Hat rating Moderaterunc security update
- Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.1.12-2.el9
- RHSA-2024:2193 Released 2024-04-30 · Red Hat rating Moderatepodman security update
- Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.9.4-0.1.el9, podman-docker-2:4.9.4-0.1.el9, podman-plugins-2:4.9.4-0.1.el9 +2
- RHSA-2024:2239 Released 2024-04-30 · Red Hat rating Moderateskopeo security update
- Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.14.3-0.1.el9, skopeo-tests-2:1.14.3-0.1.el9
- RHSA-2024:2245 Released 2024-04-30 · Red Hat rating Moderatebuildah security update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.33.6-2.el9, buildah-tests-2:1.33.6-2.el9
- RHSA-2024:2272 Released 2024-04-30 · Red Hat rating Moderatecontainernetworking-plugins security update
- Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.4.0-2.el9_4
- RHSA-2024:1901 Released 2024-04-18 · Red Hat rating ModerateRed Hat Service Interconnect 1.5.3 Release (images)
- Red Hat Service Interconnect 1 service-interconnect/skupper-config-sync-rhel9, service-interconnect/skupper-controller-podman-rhel9, service-interconnect/skupper-flow-collector-rhel9 +4
- RHSA-2024:1859 Released 2024-04-16 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.3.1 security and bug fix update
- 9Base-OADP-1.3 oadp/oadp-rhel9-operator, oadp/oadp-velero-plugin-for-csi-rhel9, oadp/oadp-velero-plugin-for-gcp-rhel9 +3
- RHSA-2024:0281 Released 2024-03-06 · Red Hat rating ModerateSecondary Scheduler Operator for Red Hat OpenShift 1.2.1 for RHEL 9
- OSSO 1.2 for RHEL 9 openshift-secondary-scheduler-operator/secondary-scheduler-operator-bundle, openshift-secondary-scheduler-operator/secondary-scheduler-rhel9-operator
- RHSA-2024:1078 Released 2024-03-05 · Red Hat rating ModerateService Telemetry Framework 1.5.4 security update
- Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8
- RHSA-2024:0269 Released 2024-02-28 · Red Hat rating ModerateRun Once Duration Override Operator for Red Hat OpenShift 1.1.0 for RHEL 9
- RODOO 1.1 for RHEL 9 run-once-duration-override-operator/run-once-duration-override-operator-bundle, run-once-duration-override-operator/run-once-duration-override-rhel9, run-once-duration-override-operator/run-once-duration-override-rhel9-operator
- RHSA-2023:7200 Released 2024-02-27 · Red Hat rating ImportantOpenShift Container Platform 4.15.z security update
- Red Hat OpenShift Container Platform 4.15 microshift-4.15.0-202402260721.p0.g799289b.assembly.4.15.0.el9, microshift-greenboot-4.15.0-202402260721.p0.g799289b.assembly.4.15.0.el9, microshift-networking-4.15.0-202402260721.p0.g799289b.assembly.4.15.0.el9 +3
- RHSA-2023:7201 Released 2024-02-27 · Red Hat rating ImportantOpenShift Container Platform 4.15.0 packages and security update
- Red Hat OpenShift Container Platform 4.15 buildah-1:1.29.1-20.2.rhaos4.15.el8, buildah-1:1.29.1-20.2.rhaos4.15.el9, buildah-tests-1:1.29.1-20.2.rhaos4.15.el8 +37
- RHSA-2024:0748 Released 2024-02-08 · Red Hat rating Importantcontainer-tools:4.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+21242+944321bb.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+21242+944321bb.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+21242+944321bb.s390x::container-tools:4.0 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 2 | Affected | No fix yet |
| Logical Volume Manager Storage | Affected | No fix yet |
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Migration Toolkit for Virtualization | Affected | No fix yet |
| NBDE Tang Server | Affected | No fix planned: Will not fix |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Power monitoring for Red Hat OpenShift | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certification for Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift on AWS | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Web Terminal | Affected | — |
| mirror registry for Red Hat OpenShift | Affected | No fix yet |
| 9Base-OADP-1.3 | Fixed | RHSA-2024:1859 |
| MTA 7.0 for RHEL 9 | Fixed | RHSA-2024:3316 |
| OSSO 1.2 for RHEL 9 | Fixed | RHSA-2024:0281 |
| RODOO 1.1 for RHEL 9 | Fixed | RHSA-2024:0269 |
| Red Hat Ceph Storage 7.1 Tools | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:0748, RHSA-2024:2988 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:2180, RHSA-2024:2193, RHSA-2024:2239, RHSA-2024:2245, RHSA-2024:2272 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:4429 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2023:7200, RHSA-2023:7201 |
| Red Hat OpenStack Platform 17.1 | Fixed | RHSA-2024:2729, RHSA-2024:2730, RHSA-2024:2767 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2024:1901 |
| Service Telemetry Framework 1.5 for RHEL 8 | Fixed | RHSA-2024:1078 |
Not affected: 27 products
- 9Base-OADP-1.3
- Cost Management Metrics Operator
- Custom Metric Autoscaler operator for Red Hat Openshift
- Fence Agents Remediation Operator
- Ironic content for Red Hat OpenShift Container Platform 4.15
- Logging Subsystem for Red Hat OpenShift
- MTA 7.0 for RHEL 8
- MTA 7.0 for RHEL 9
- Machine Deletion Remediation Operator
- Network Observability Operator
- Node HealthCheck Operator
- Node Maintenance Operator
- OpenShift Serverless
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift GitOps
- Red Hat OpenShift Virtualization 4
- Red Hat OpenShift distributed tracing 2
- Red Hat OpenShift distributed tracing 3
- Red Hat Satellite 6
- Self Node Remediation Operator
- Service Telemetry Framework 1.5 for RHEL 8
- cert-manager Operator for Red Hat OpenShift
Timeline
- 2026-10-02 Threatist record created from CVE-2023-45287
- 2026-10-03 Alias added: GHSA-33qr-2xwr-95pw
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-45287 · CVE Program
- CVE-2023-45287 · NVD
- FIRST EPSS
- GHSA-33qr-2xwr-95pw · GitHub Advisory Database · CC BY 4.0
- CVE-2023-45287 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences