CVE-2022-41724
Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).
Published:Feb 15, 2023
Last Modified:Mar 7, 2025
EPS:Feb 28, 2023
EPSS Score:0.00016
CVSS Score:7.5
Affected Products
Vendor
Product
Action
Vendor
Golang
Product
Go
Golang
Go
Vendor
Redhat
Product
Ansible Automation Platform
Redhat
Ansible Automation Platform
Vendor
Redhat
Product
Cert Manager
Redhat
Cert Manager
Vendor
Redhat
Product
Container Native Virtualization
Redhat
Container Native Virtualization
Vendor
Redhat
Product
Cryostat
Redhat
Cryostat
Vendor
Redhat
Product
Enterprise Linux
Redhat
Enterprise Linux
Vendor
Redhat
Product
Migration Toolkit Applications
Redhat
Migration Toolkit Applications
Vendor
Redhat
Product
Migration Toolkit Virtualization
Redhat
Migration Toolkit Virtualization
Vendor
Redhat
Product
Network Observ Optr
Redhat
Network Observ Optr
Vendor
Redhat
Product
Openshift
Redhat
Openshift
Vendor
Redhat
Product
Openshift Api Data Protection
Redhat
Openshift Api Data Protection
Vendor
Redhat
Product
Openshift Data Foundation
Redhat
Openshift Data Foundation
Vendor
Redhat
Product
Openshift Secondary Scheduler
Redhat
Openshift Secondary Scheduler
Vendor
Redhat
Product
Openshift Serverless
Redhat
Openshift Serverless
Vendor
Redhat
Product
Openstack
Redhat
Openstack
Vendor
Redhat
Product
Rhmt
Redhat
Rhmt
Vendor
Redhat
Product
Rhosemc
Redhat
Rhosemc
Vendor
Redhat
Product
Serverless
Redhat
Serverless
Vendor
Redhat
Product
Service Interconnect
Redhat
Service Interconnect
Vendor
Redhat
Product
Stf
Redhat
Stf
Exploits
No exploit reference
Common Weakness Enumeration
Common Attack Pattern Enumeration and Classification (CAPEC)
Related CVEs
References
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
