Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golang-raceUpgrade podman-remoteUpgrade criu-develUpgrade containernetworking-pluginsUpgrade golang-miscUpgrade podmanUpgrade netavarkUpgrade golang-binUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade criuUpgrade toolbox-testsUpgrade golang-docsUpgrade podman-catatonitUpgrade golang-testsUpgrade udicaUpgrade critUpgrade crunUpgrade runcUpgrade toolboxUpgrade skopeoUpgrade containers-commonUpgrade fuse-overlayfsUpgrade golangUpgrade conmonUpgrade criu-libsUpgrade skopeo-testsUpgrade python3-criuUpgrade podman-testsUpgrade python3-podmanUpgrade container-selinuxUpgrade podman-dockerUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade golang-srcUpgrade libslirpUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade libslirp-develUpgrade buildah-testsUpgrade buildahUpgrade go-toolset | Oct 18, 2023 | Aug 2, 2023 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 2, 2023 |
| Amazon Linux Ami 2 | — | Upgrade golang-binUpgrade ecs-initUpgrade golang-miscUpgrade cni-pluginsUpgrade golangUpgrade golang-srcUpgrade golang-testsUpgrade nerdctlUpgrade runcUpgrade golang-docsUpgrade cni-plugins-debuginfoUpgrade golang-sharedUpgrade containerd-debuginfoUpgrade dockerUpgrade cri-toolsUpgrade containerdUpgrade containerd-stressUpgrade runc-debuginfoUpgrade amazon-ssm-agentUpgrade nerdctl-debuginfoUpgrade amazon-ssm-agent-debuginfoUpgrade amazon-cloudwatch-agentUpgrade docker-debuginfoUpgrade cri-tools-debuginfo | Aug 24, 2023 | Aug 2, 2023 |
| Amazon_linux | — | Upgrade golangUpgrade containerd | Oct 7, 2023 | Aug 2, 2023 |
| Amazon_linux_2023 | — | Upgrade golang-miscUpgrade golang-testsUpgrade golang-binUpgrade containerd-debuginfoUpgrade golangUpgrade containerd-debugsourceUpgrade amazon-ssm-agent-debugsourceUpgrade dockerUpgrade golang-docsUpgrade containerdUpgrade containerd-stressUpgrade amazon-ssm-agent-debuginfoUpgrade nerdctlUpgrade cni-plugins-debuginfoUpgrade amazon-ssm-agentUpgrade docker-debugsourceUpgrade docker-debuginfoUpgrade containerd-stress-debuginfoUpgrade cni-plugins-debugsourceUpgrade golang-srcUpgrade ecs-initUpgrade cni-pluginsUpgrade amazon-ecr-credential-helperUpgrade amazon-cloudwatch-agentUpgrade golang-shared | Feb 17, 2025 | Aug 2, 2023 |
| Centos_linux | — | Upgrade slirp4netns-debugsourceUpgrade podman-catatonitUpgrade podman-pluginsUpgrade libslirp-debugsourceUpgrade toolbox-debuginfoUpgrade python3-criuUpgrade slirp4netns-debuginfoUpgrade conmon-debuginfoUpgrade golang-testsUpgrade golang-binUpgrade podman-remoteUpgrade runcUpgrade containernetworking-plugins-debugsourceUpgrade podman-plugins-debuginfoUpgrade criuUpgrade podman-debuginfoUpgrade podmanUpgrade podman-gvproxyUpgrade container-selinuxUpgrade containernetworking-plugins-debuginfoUpgrade podman-testsUpgrade skopeo-debuginfoUpgrade libslirp-debuginfoUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade golang-docsUpgrade buildah-debugsourceUpgrade udicaUpgrade toolbox-testsUpgrade criu-develUpgrade critUpgrade podman-debugsourceUpgrade toolbox-debugsourceUpgrade containernetworking-pluginsUpgrade criu-libs-debuginfoUpgrade crunUpgrade podman-catatonit-debuginfoUpgrade go-toolsetUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-dockerUpgrade podman-gvproxy-debuginfoUpgrade skopeo-testsUpgrade containers-commonUpgrade conmon-debugsourceUpgrade crun-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade conmonUpgrade libslirp-develUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade criu-debugsourceUpgrade toolboxUpgrade golang-raceUpgrade skopeo-debugsourceUpgrade libslirpUpgrade golangUpgrade criu-libsUpgrade golang-srcUpgrade fuse-overlayfs-debuginfoUpgrade aardvark-dnsUpgrade skopeoUpgrade netavarkUpgrade podman-remote-debuginfoUpgrade golang-miscUpgrade buildah-tests-debuginfoUpgrade buildah-testsUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfsUpgrade crun-debugsourceUpgrade buildahUpgrade python3-podmanUpgrade runc-debugsourceUpgrade runc-debuginfo | Nov 1, 2023 | Aug 2, 2023 |
| Debian | — | No solution exists | May 15, 2025 | Aug 2, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Jan 10, 2024 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jan 10, 2024 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-srcUpgrade golangUpgrade golang-bin | Feb 12, 2024 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Jan 10, 2024 | Aug 2, 2023 |
| Oracle_linux | — | Upgrade container-selinuxUpgrade podman-dockerUpgrade runcUpgrade python3-criuUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hookUpgrade golang-docsUpgrade podman-gvproxyUpgrade buildah-testsUpgrade go-toolsetUpgrade buildahUpgrade libslirpUpgrade podman-remoteUpgrade cockpit-podmanUpgrade libslirp-develUpgrade slirp4netnsUpgrade critUpgrade udicaUpgrade criu-libsUpgrade skopeo-testsUpgrade criu-develUpgrade skopeoUpgrade podman-pluginsUpgrade golang-miscUpgrade fuse-overlayfsUpgrade golang-testsUpgrade crunUpgrade podmanUpgrade golang-srcUpgrade python3-podmanUpgrade podman-catatonitUpgrade containernetworking-pluginsUpgrade criuUpgrade golangUpgrade netavarkUpgrade golang-binUpgrade conmonUpgrade containers-commonUpgrade golang-raceUpgrade podman-tests | Oct 19, 2023 | Aug 2, 2023 |
| Redhat Openshift | — | Upgrade openshift-clientsUpgrade podmanUpgrade microshiftUpgrade openshiftUpgrade runc | Nov 16, 2023 | Aug 2, 2023 |
| Redhat_linux | — | Upgrade python3-podmanUpgrade podman-gvproxyUpgrade golang-miscUpgrade podman-pluginsUpgrade libslirpUpgrade skopeo-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debuginfoUpgrade podman-testsUpgrade conmonUpgrade delve-debuginfoUpgrade skopeoUpgrade criu-libsUpgrade buildah-tests-debuginfoUpgrade delve-debugsourceUpgrade golangUpgrade cockpit-podmanUpgrade podman-catatonit-debuginfoUpgrade podman-dockerUpgrade buildahUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debugsourceUpgrade golang-raceUpgrade libslirp-develUpgrade toolboxUpgrade skopeo-debuginfoUpgrade golang-srcUpgrade slirp4netnsUpgrade fuse-overlayfsUpgrade containers-commonUpgrade containernetworking-plugins-debugsourceUpgrade crunUpgrade crun-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade netavarkUpgrade criu-debuginfoUpgrade conmon-debugsourceUpgrade criuUpgrade libslirp-debugsourceUpgrade delveUpgrade buildah-testsUpgrade skopeo-testsUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-pluginsNo solution existsUpgrade golang-docsUpgrade python3-criuUpgrade criu-libs-debuginfoUpgrade toolbox-testsUpgrade udicaUpgrade golang-binUpgrade runcUpgrade podmanUpgrade container-selinuxUpgrade podman-remote-debuginfoUpgrade criu-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade golang-testsUpgrade libslirp-debuginfoUpgrade conmon-debuginfoUpgrade podman-catatonitUpgrade criu-develUpgrade runc-debuginfoUpgrade slirp4netns-debuginfoUpgrade podman-remoteUpgrade toolbox-debugsourceUpgrade crun-debugsourceUpgrade critUpgrade go-toolsetUpgrade podman-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade runc-debugsourceUpgrade aardvark-dnsUpgrade toolbox-debuginfo | Nov 1, 2023 | Aug 2, 2023 |
| Rocky_linux | — | Upgrade buildah-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netns-debugsourceUpgrade netavarkUpgrade skopeoUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade libslirpUpgrade crunUpgrade toolboxUpgrade toolbox-debugsourceUpgrade criu-develUpgrade conmonUpgrade libslirp-develUpgrade skopeo-testsUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade slirp4netns-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade toolbox-debuginfoUpgrade criu-libsUpgrade skopeo-debuginfoUpgrade crun-debugsourceUpgrade runcUpgrade containernetworking-pluginsUpgrade conmon-debugsourceUpgrade slirp4netnsUpgrade python3-criuUpgrade fuse-overlayfsUpgrade aardvark-dnsUpgrade toolbox-testsUpgrade buildah-tests-debuginfoUpgrade conmon-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade skopeo-debugsourceUpgrade criuUpgrade runc-debugsourceUpgrade crun-debuginfoUpgrade criu-debuginfoUpgrade buildah-testsUpgrade critUpgrade buildahUpgrade criu-debugsourceUpgrade containers-commonUpgrade libslirp-debuginfo | Mar 5, 2024 | Aug 2, 2023 |
| Suse | — | Upgrade golang-github-prometheus-node_exporterUpgrade go1.19-docUpgrade grafanaUpgrade go1.20-raceUpgrade go1.19-raceUpgrade go1.19-opensslUpgrade go1.19-openssl-docUpgrade go1.20-docUpgrade prometheus-postgres_exporterUpgrade go1.20Upgrade go1.20-openssl-docUpgrade go1.19-openssl-raceUpgrade go1.19Upgrade go1.20-opensslUpgrade golang-github-lusitaniae-apache_exporterUpgrade spacecmdUpgrade golang-github-qubitproducts-exporter_exporterUpgrade golang-github-prometheus-alertmanagerUpgrade go1.20-openssl-raceUpgrade supportutils-plugin-susemanager-clientUpgrade prometheus-blackbox_exporter | Aug 4, 2023 | Aug 2, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 2, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub