Bug 2253193 (CVE-2023-45287)
| Summary: | CVE-2023-45287 golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Patrick Del Bello <pdelbell> |
| Component: | vulnerability | Assignee: | Sayan Biswas <sabiswas> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aazores, abishop, adudiak, ahanwate, amasferr, amctagga, ansmith, aoconnor, asatyam, askrabec, bbuckingham, bcourt, bdettelb, bniver, bodavis, chazlett, davidn, dbenoit, debarshir, dfreiber, dhanak, diagrawa, dkenigsb, dperaza, drow, dsimansk, dymurray, eaguilar, ebaron, eglynn, ehelms, emachado, epacific, fdeutsch, flucifre, ganandan, gmeno, gparvin, gsuckevi, jaharrin, jburrell, jcammara, jcantril, jchui, jeder, jhardy, jjoyce, jkang, jkoehler, jmatthew, jneedle, jobarker, joelsmith, jpallich, jschluet, jsherril, kaycoth, kingland, kshier, kverlaen, lbainbri, lhh, lmadsen, lsvaty, lzap, mabashia, matzew, mbenjamin, mbocek, mburns, mcressma, mgarciac, mhackett, mhulan, mkudlej, mmagr, mnewsome, mnovotny, mrunge, mwringe, njean, nmoumoul, nobody, orabin, oramraz, owatkins, pahickey, pcreech, peholase, pgrist, pierdipi, pjindal, rchan, rguimara, rhaigner, rhos-maint, rhuss, rjohnson, saroy, sdawley, sfroberg, shbose, simaishi, sipoyare, skontopo, smcdonal, smullick, sostapov, stcannon, teagle, tfister, tjochec, tsweeney, vereddy, vimalkum, vkumar, whayutin, yguenane, zsadeh |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | Flags: | tsweeney:
needinfo?
(pdelbell) |
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | golang 1.20 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the Golang crypto/tls standard library. In previous versions, the package was vulnerable to a Timing Side Channel attack by observing the time it took for RSA-based TLS key exchanges, which was not constant. This flaw allows a malicious user to gather information from the environment.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2253205, 2253206, 2253207, 2253208, 2253194, 2253195, 2253197, 2253198, 2253199, 2253201, 2253202, 2253203, 2253204, 2253209, 2253210, 2253213, 2253214, 2279582 | ||
| Bug Blocks: | 2253190 | ||
|
Description
Patrick Del Bello
2023-12-06 13:50:49 UTC
Created golang tracking bugs for this issue: Affects: epel-all [bug 2253194] Affects: fedora-all [bug 2253195] I see that there are bugs created for toolbox in RHEL 8, but not RHEL 9. Why is that? The code is exactly the same in both. Thanks for highlighting that debarshir. Allow me to check internally. is there any advisory which shows in which exact golang version this CVE is fixed? This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:0748 https://access.redhat.com/errata/RHSA-2024:0748 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2023:7201 https://access.redhat.com/errata/RHSA-2023:7201 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2023:7200 https://access.redhat.com/errata/RHSA-2023:7200 This issue has been addressed in the following products: RODOO-1.1-RHEL-9 Via RHSA-2024:0269 https://access.redhat.com/errata/RHSA-2024:0269 This issue has been addressed in the following products: STF-1.5-RHEL-8 Via RHSA-2024:1078 https://access.redhat.com/errata/RHSA-2024:1078 This issue has been addressed in the following products: OSSO-1.2-RHEL-9 Via RHSA-2024:0281 https://access.redhat.com/errata/RHSA-2024:0281 This issue has been addressed in the following products: OADP-1.3-RHEL-9 Via RHSA-2024:1859 https://access.redhat.com/errata/RHSA-2024:1859 This issue has been addressed in the following products: Service Interconnect 1 for RHEL 9 Via RHSA-2024:1901 https://access.redhat.com/errata/RHSA-2024:1901 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:2180 https://access.redhat.com/errata/RHSA-2024:2180 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:2193 https://access.redhat.com/errata/RHSA-2024:2193 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:2239 https://access.redhat.com/errata/RHSA-2024:2239 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:2245 https://access.redhat.com/errata/RHSA-2024:2245 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:2272 https://access.redhat.com/errata/RHSA-2024:2272 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:2988 https://access.redhat.com/errata/RHSA-2024:2988 This issue has been addressed in the following products: Red Hat OpenStack Platform 17.1 for RHEL 8 Via RHSA-2024:2767 https://access.redhat.com/errata/RHSA-2024:2767 This issue has been addressed in the following products: Red Hat OpenStack Platform 17.1 for RHEL 9 Via RHSA-2024:2729 https://access.redhat.com/errata/RHSA-2024:2729 This issue has been addressed in the following products: Red Hat OpenStack Platform 17.1 for RHEL 9 Via RHSA-2024:2730 https://access.redhat.com/errata/RHSA-2024:2730 This issue has been addressed in the following products: MTA-7.0-RHEL-9 MTA-7.0-RHEL-8 Via RHSA-2024:3316 https://access.redhat.com/errata/RHSA-2024:3316 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:4429 https://access.redhat.com/errata/RHSA-2024:4429 |