REDHAT-BUG-2437111: Medium severity go crypto/tls (Go standard library) vulnerability
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2437111?
The severity of REDHAT-BUG-2437111 is considered significant due to the potential for unauthorized session resumption.
How do I fix REDHAT-BUG-2437111?
To fix REDHAT-BUG-2437111, ensure that the ClientCAs or RootCAs fields are not mutated between the initial handshake and the resumed handshake.
Which software is affected by REDHAT-BUG-2437111?
REDHAT-BUG-2437111 affects Go crypto/tls, which is part of the Go standard library.
What is the impact of REDHAT-BUG-2437111?
The impact of REDHAT-BUG-2437111 is that it may allow a resumed handshake to succeed incorrectly, leading to potential security vulnerabilities.
When was REDHAT-BUG-2437111 reported?
REDHAT-BUG-2437111 was reported in the context of session resumption issues in TLS.