Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-criuUpgrade skopeo-testsUpgrade python3-podmanUpgrade golang-srcUpgrade buildah-testsUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade libslirp-develUpgrade criu-libsUpgrade podman-gvproxyUpgrade go-toolsetUpgrade podman-dockerUpgrade libslirpUpgrade conmonUpgrade container-selinuxUpgrade aardvark-dnsUpgrade buildahUpgrade podman-testsUpgrade podman-pluginsUpgrade golangUpgrade toolboxUpgrade toolbox-testsUpgrade podman-remoteUpgrade golang-testsUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonitUpgrade golang-miscUpgrade golang-binUpgrade fuse-overlayfsUpgrade crunUpgrade critUpgrade netavarkUpgrade criu-develUpgrade criuUpgrade skopeoUpgrade containernetworking-pluginsUpgrade udicaUpgrade golang-raceUpgrade podmanUpgrade runcUpgrade golang-docs | Oct 18, 2023 | Aug 2, 2023 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 2, 2023 |
| Amazon Linux Ami 2 | — | Upgrade containerdUpgrade docker-debuginfoUpgrade nerdctl-debuginfoUpgrade containerd-debuginfoUpgrade amazon-cloudwatch-agentUpgrade amazon-ssm-agentUpgrade cri-toolsUpgrade amazon-ssm-agent-debuginfoUpgrade dockerUpgrade cri-tools-debuginfoUpgrade containerd-stressUpgrade runc-debuginfoUpgrade golang-sharedUpgrade ecs-initUpgrade golang-srcUpgrade cni-plugins-debuginfoUpgrade golang-docsUpgrade golang-testsUpgrade golangUpgrade golang-miscUpgrade runcUpgrade cni-pluginsUpgrade golang-binUpgrade nerdctl | Aug 24, 2023 | Aug 2, 2023 |
| Amazon_linux | — | Upgrade golangUpgrade containerd | Oct 7, 2023 | Aug 2, 2023 |
| Amazon_linux_2023 | — | Upgrade golang-miscUpgrade golang-binUpgrade containerd-debugsourceUpgrade golang-docsUpgrade golangUpgrade containerdUpgrade containerd-debuginfoUpgrade amazon-ssm-agent-debuginfoUpgrade golang-testsUpgrade containerd-stressUpgrade amazon-ssm-agent-debugsourceUpgrade dockerUpgrade cni-plugins-debuginfoUpgrade docker-debugsourceUpgrade golang-sharedUpgrade amazon-ssm-agentUpgrade golang-srcUpgrade ecs-initUpgrade docker-debuginfoUpgrade containerd-stress-debuginfoUpgrade cni-plugins-debugsourceUpgrade nerdctlUpgrade amazon-cloudwatch-agentUpgrade amazon-ecr-credential-helperUpgrade cni-plugins | Feb 17, 2025 | Aug 2, 2023 |
| Centos_linux | — | Upgrade criuUpgrade conmon-debuginfoUpgrade podmanUpgrade podman-catatonitUpgrade golang-binUpgrade podman-pluginsUpgrade python3-criuUpgrade podman-debuginfoUpgrade podman-plugins-debuginfoUpgrade cockpit-podmanUpgrade containernetworking-plugins-debugsourceUpgrade golang-docsUpgrade podman-catatonit-debuginfoUpgrade podman-debugsourceUpgrade container-selinuxUpgrade libslirp-debuginfoUpgrade buildah-debugsourceUpgrade critUpgrade toolbox-testsUpgrade criu-libs-debuginfoUpgrade toolbox-debugsourceUpgrade crunUpgrade podman-gvproxyUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade go-toolsetUpgrade podman-dockerUpgrade udicaUpgrade podman-gvproxy-debuginfoUpgrade runcUpgrade skopeo-testsUpgrade slirp4netnsUpgrade golang-testsUpgrade criu-develUpgrade slirp4netns-debugsourceUpgrade containernetworking-pluginsUpgrade podman-testsUpgrade skopeo-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debuginfoUpgrade toolbox-debuginfoUpgrade libslirp-debugsourceUpgrade podman-remoteUpgrade toolboxUpgrade containers-commonUpgrade buildah-tests-debuginfoUpgrade buildah-testsUpgrade skopeo-debugsourceUpgrade buildahUpgrade python3-podmanUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfsUpgrade crun-debugsourceUpgrade conmonUpgrade golang-miscUpgrade golang-raceUpgrade criu-libsUpgrade golangUpgrade skopeoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade netavarkUpgrade crun-debuginfoUpgrade buildah-debuginfoUpgrade criu-debugsourceUpgrade libslirp-develUpgrade podman-remote-debuginfoUpgrade runc-debugsourceUpgrade runc-debuginfoUpgrade conmon-debugsourceUpgrade criu-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade libslirpUpgrade aardvark-dnsUpgrade golang-src | Nov 1, 2023 | Aug 2, 2023 |
| Debian | — | No solution exists | May 15, 2025 | Aug 2, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jan 10, 2024 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Jan 10, 2024 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golang-srcUpgrade golang | Feb 12, 2024 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Jan 10, 2024 | Aug 2, 2023 |
| Oracle_linux | — | Upgrade skopeo-testsUpgrade udicaUpgrade cockpit-podmanUpgrade libslirp-develUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hookUpgrade buildah-testsUpgrade libslirpUpgrade go-toolsetUpgrade podman-dockerUpgrade runcUpgrade aardvark-dnsUpgrade critUpgrade golang-docsUpgrade container-selinuxUpgrade criu-develUpgrade podman-gvproxyUpgrade podman-remoteUpgrade python3-criuUpgrade buildahUpgrade criu-libsUpgrade containernetworking-pluginsUpgrade podman-testsUpgrade skopeoUpgrade containers-commonUpgrade golang-raceUpgrade golangUpgrade golang-srcUpgrade python3-podmanUpgrade podman-catatonitUpgrade crunUpgrade golang-testsUpgrade golang-miscUpgrade fuse-overlayfsUpgrade podman-pluginsUpgrade podmanUpgrade golang-binUpgrade criuUpgrade conmonUpgrade netavark | Oct 19, 2023 | Aug 2, 2023 |
| Redhat Openshift | — | Upgrade openshift-clientsUpgrade microshiftUpgrade openshiftUpgrade podmanUpgrade runc | Nov 16, 2023 | Aug 2, 2023 |
| Redhat_linux | — | Upgrade libslirp-debugsourceUpgrade critUpgrade runc-debuginfoNo solution existsUpgrade podman-gvproxy-debuginfoUpgrade podman-catatonitUpgrade runcUpgrade podman-debuginfoUpgrade podman-remote-debuginfoUpgrade container-selinuxUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade criu-develUpgrade delveUpgrade podman-debugsourceUpgrade toolbox-testsUpgrade criu-debugsourceUpgrade slirp4netns-debugsourceUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-pluginsUpgrade golang-docsUpgrade podman-remoteUpgrade buildah-testsUpgrade crun-debugsourceUpgrade go-toolsetUpgrade aardvark-dnsUpgrade criu-libs-debuginfoUpgrade toolbox-debuginfoUpgrade golang-binUpgrade python3-criuUpgrade golang-testsUpgrade podmanUpgrade skopeo-testsUpgrade podman-plugins-debuginfoUpgrade runc-debugsourceUpgrade libslirp-debuginfoUpgrade udicaUpgrade slirp4netns-debuginfoUpgrade crunUpgrade containers-commonUpgrade conmon-debugsourceUpgrade python3-podmanUpgrade criu-debuginfoUpgrade netavarkUpgrade criuUpgrade golang-srcUpgrade oci-seccomp-bpf-hookUpgrade crun-debuginfoUpgrade podman-testsUpgrade fuse-overlayfs-debugsourceUpgrade cockpit-podmanUpgrade delve-debugsourceUpgrade buildah-debugsourceUpgrade fuse-overlayfsUpgrade containernetworking-plugins-debugsourceUpgrade delve-debuginfoUpgrade conmonUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade buildah-debuginfoUpgrade skopeo-debugsourceUpgrade skopeo-debuginfoUpgrade podman-catatonit-debuginfoUpgrade golang-miscUpgrade skopeoUpgrade libslirpUpgrade golangUpgrade podman-pluginsUpgrade criu-libsUpgrade toolboxUpgrade podman-dockerUpgrade libslirp-develUpgrade golang-raceUpgrade fuse-overlayfs-debuginfoUpgrade buildahUpgrade buildah-tests-debuginfo | Nov 1, 2023 | Aug 2, 2023 |
| Rocky_linux | — | Upgrade criu-debuginfoUpgrade runc-debugsourceUpgrade skopeo-debugsourceUpgrade libslirp-debuginfoUpgrade criuUpgrade conmon-debugsourceUpgrade containernetworking-pluginsUpgrade fuse-overlayfsUpgrade skopeo-debuginfoUpgrade python3-criuUpgrade toolbox-debuginfoUpgrade buildahUpgrade buildah-tests-debuginfoUpgrade buildah-testsUpgrade criu-libsUpgrade crun-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade toolbox-testsUpgrade oci-seccomp-bpf-hookUpgrade criu-debugsourceUpgrade aardvark-dnsUpgrade buildah-debuginfoUpgrade containers-commonUpgrade critUpgrade runcUpgrade conmon-debuginfoUpgrade crun-debugsourceUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netns-debugsourceUpgrade criu-develUpgrade toolboxUpgrade crunUpgrade libslirp-develUpgrade runc-debuginfoUpgrade slirp4netns-debuginfoUpgrade criu-libs-debuginfoUpgrade toolbox-debugsourceUpgrade skopeoUpgrade skopeo-testsUpgrade fuse-overlayfs-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade netavarkUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirpUpgrade libslirp-debugsourceUpgrade conmon | Mar 5, 2024 | Aug 2, 2023 |
| Suse | — | Upgrade spacecmdUpgrade go1.20-openssl-raceUpgrade golang-github-prometheus-alertmanagerUpgrade go1.20-opensslUpgrade supportutils-plugin-susemanager-clientUpgrade golang-github-lusitaniae-apache_exporterUpgrade go1.19-openssl-raceUpgrade go1.20-openssl-docUpgrade golang-github-qubitproducts-exporter_exporterUpgrade prometheus-blackbox_exporterUpgrade go1.19Upgrade go1.19-opensslUpgrade go1.20-raceUpgrade go1.19-docUpgrade grafanaUpgrade golang-github-prometheus-node_exporterUpgrade prometheus-postgres_exporterUpgrade go1.20Upgrade go1.19-openssl-docUpgrade go1.20-docUpgrade go1.19-race | Aug 4, 2023 | Aug 2, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 2, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub