Asymmetric denial of service - ReDoS In golang-1.19
Description
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 rpm rhel9 | 1:1.9.0-4.el9_8 | ||
rpm rhel10 | - | - | |
rpm rhel10 | - | - | |
rpm rhel10 | 0:1.26.7-1.el10_2 | ||
rpm rhel9 | 0:165.1-4.el9_8.1 | ||
rpm rhel8 | 0:101.5-2.el8_10 | ||
rpm rhel9 | - | - | |
rpm rhel9 | 0:3.7.1-4.el9_8.3 | ||
rpm rhel8 | 0:5.1.1-18.el8_10 | ||
rpm rhel10 | 0:165.1-3.el10_2.2 |
1-10 of 74
10
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3.