Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade conmonUpgrade podman-dockerUpgrade python3-podmanUpgrade criu-libsUpgrade podman-testsUpgrade buildah-testsUpgrade libslirp-develUpgrade go-toolsetUpgrade cockpit-podmanUpgrade container-selinuxUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade buildahUpgrade aardvark-dnsUpgrade golang-srcUpgrade skopeo-testsUpgrade libslirpUpgrade python3-criuUpgrade golangUpgrade podman-pluginsUpgrade critUpgrade criuUpgrade runcUpgrade toolbox-testsUpgrade podman-catatonitUpgrade udicaUpgrade crunUpgrade oci-seccomp-bpf-hookUpgrade netavarkUpgrade golang-miscUpgrade skopeoUpgrade golang-raceUpgrade criu-develUpgrade golang-testsUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade golang-binUpgrade toolboxUpgrade fuse-overlayfsUpgrade golang-docsUpgrade podman | Oct 18, 2023 | Aug 2, 2023 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 2, 2023 |
| Amazon Linux Ami 2 | — | Upgrade nerdctl-debuginfoUpgrade cri-toolsUpgrade containerd-stressUpgrade amazon-ssm-agentUpgrade dockerUpgrade cri-tools-debuginfoUpgrade runc-debuginfoUpgrade containerd-debuginfoUpgrade golang-sharedUpgrade docker-debuginfoUpgrade containerdUpgrade amazon-cloudwatch-agentUpgrade amazon-ssm-agent-debuginfoUpgrade golang-binUpgrade golang-testsUpgrade golang-srcUpgrade golang-docsUpgrade ecs-initUpgrade golang-miscUpgrade nerdctlUpgrade cni-pluginsUpgrade golangUpgrade cni-plugins-debuginfoUpgrade runc | Aug 24, 2023 | Aug 2, 2023 |
| Amazon_linux | — | Upgrade golangUpgrade containerd | Oct 7, 2023 | Aug 2, 2023 |
| Amazon_linux_2023 | — | Upgrade containerd-debugsourceUpgrade golangUpgrade containerdUpgrade amazon-ssm-agent-debuginfoUpgrade amazon-ssm-agent-debugsourceUpgrade dockerUpgrade golang-docsUpgrade containerd-stressUpgrade golang-miscUpgrade containerd-debuginfoUpgrade golang-binUpgrade golang-testsUpgrade docker-debuginfoUpgrade containerd-stress-debuginfoUpgrade docker-debugsourceUpgrade ecs-initUpgrade cni-plugins-debugsourceUpgrade cni-plugins-debuginfoUpgrade amazon-ssm-agentUpgrade golang-sharedUpgrade nerdctlUpgrade cni-pluginsUpgrade amazon-ecr-credential-helperUpgrade amazon-cloudwatch-agentUpgrade golang-src | Feb 17, 2025 | Aug 2, 2023 |
| Centos_linux | — | Upgrade containernetworking-pluginsUpgrade criu-develUpgrade podman-dockerUpgrade podman-catatonitUpgrade conmon-debuginfoUpgrade podman-debugsourceUpgrade toolbox-debugsourceUpgrade podman-catatonit-debuginfoUpgrade buildah-debugsourceUpgrade critUpgrade criu-libs-debuginfoUpgrade crunUpgrade slirp4netns-debugsourceUpgrade slirp4netns-debuginfoUpgrade toolbox-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade golang-testsUpgrade podman-gvproxy-debuginfoUpgrade skopeo-testsUpgrade toolbox-testsUpgrade libslirp-debugsourceUpgrade podman-remoteUpgrade podman-pluginsUpgrade podman-testsUpgrade podmanUpgrade skopeo-debuginfoUpgrade slirp4netnsUpgrade python3-criuUpgrade golang-docsUpgrade criuUpgrade cockpit-podmanUpgrade go-toolsetUpgrade container-selinuxUpgrade golang-binUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-debuginfoUpgrade podman-gvproxyUpgrade runcUpgrade podman-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade udicaUpgrade podman-debuginfoUpgrade libslirpUpgrade golang-srcUpgrade fuse-overlayfs-debuginfoUpgrade runc-debugsourceUpgrade buildahUpgrade crun-debugsourceUpgrade buildah-tests-debuginfoUpgrade buildah-testsUpgrade podman-remote-debuginfoUpgrade golang-miscUpgrade aardvark-dnsUpgrade skopeo-debugsourceUpgrade runc-debuginfoUpgrade containers-commonUpgrade conmon-debugsourceUpgrade conmonUpgrade python3-podmanUpgrade buildah-debuginfoUpgrade criu-debuginfoUpgrade golangUpgrade criu-libsUpgrade toolboxUpgrade golang-raceUpgrade crun-debuginfoUpgrade skopeoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade netavarkUpgrade fuse-overlayfsUpgrade criu-debugsourceUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsource | Nov 1, 2023 | Aug 2, 2023 |
| Debian | — | No solution exists | May 15, 2025 | Aug 2, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Jan 10, 2024 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Jan 10, 2024 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golangUpgrade golang-srcUpgrade golang-bin | Feb 12, 2024 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jan 10, 2024 | Aug 2, 2023 |
| Oracle_linux | — | Upgrade podman-pluginsUpgrade golangUpgrade golang-miscUpgrade golang-testsUpgrade containernetworking-pluginsUpgrade fuse-overlayfsUpgrade crunUpgrade podman-testsUpgrade podman-catatonitUpgrade podmanUpgrade golang-raceUpgrade criuUpgrade golang-binUpgrade netavarkUpgrade containers-commonUpgrade golang-srcUpgrade conmonUpgrade skopeoUpgrade python3-podmanUpgrade libslirpUpgrade go-toolsetUpgrade buildah-testsUpgrade libslirp-develUpgrade podman-gvproxyUpgrade golang-docsUpgrade aardvark-dnsUpgrade skopeo-testsUpgrade container-selinuxUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade criu-libsUpgrade udicaUpgrade runcUpgrade buildahUpgrade python3-criuUpgrade podman-remoteUpgrade podman-dockerUpgrade oci-seccomp-bpf-hookUpgrade critUpgrade criu-devel | Oct 19, 2023 | Aug 2, 2023 |
| Redhat Openshift | — | Upgrade microshiftUpgrade openshift-clientsUpgrade openshiftUpgrade podmanUpgrade runc | Nov 16, 2023 | Aug 2, 2023 |
| Redhat_linux | — | Upgrade podman-pluginsUpgrade containernetworking-plugins-debugsourceUpgrade libslirpUpgrade skopeo-debugsourceUpgrade golang-miscUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade crunUpgrade slirp4netnsUpgrade crun-debuginfoUpgrade containers-commonUpgrade golang-srcUpgrade buildah-tests-debuginfoUpgrade delve-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade golangUpgrade criu-libsUpgrade libslirp-develUpgrade buildahUpgrade skopeoUpgrade fuse-overlayfsUpgrade buildah-debugsourceUpgrade golang-raceUpgrade netavarkUpgrade podman-dockerUpgrade toolboxUpgrade podman-testsUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade delve-debugsourceUpgrade podman-catatonit-debuginfoUpgrade conmon-debugsourceUpgrade conmonUpgrade skopeo-debuginfoUpgrade buildah-debuginfoUpgrade python3-podmanUpgrade criuUpgrade criu-debuginfoUpgrade runc-debugsourceUpgrade criu-libs-debuginfoUpgrade aardvark-dnsUpgrade crun-debugsourceNo solution existsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-plugins-debuginfoUpgrade criu-develUpgrade golang-docsUpgrade container-selinuxUpgrade podman-remoteUpgrade podman-debugsourceUpgrade critUpgrade python3-criuUpgrade udicaUpgrade podmanUpgrade libslirp-debugsourceUpgrade golang-binUpgrade toolbox-testsUpgrade skopeo-testsUpgrade slirp4netns-debuginfoUpgrade toolbox-debugsourceUpgrade buildah-testsUpgrade delveUpgrade slirp4netns-debugsourceUpgrade toolbox-debuginfoUpgrade go-toolsetUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade podman-gvproxy-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade runc-debuginfoUpgrade runcUpgrade podman-remote-debuginfoUpgrade podman-catatonitUpgrade golang-testsUpgrade conmon-debuginfoUpgrade criu-debugsourceUpgrade podman-debuginfoUpgrade libslirp-debuginfo | Nov 1, 2023 | Aug 2, 2023 |
| Rocky_linux | — | Upgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolboxUpgrade conmonUpgrade containernetworking-plugins-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade libslirpUpgrade toolbox-debugsourceUpgrade skopeo-testsUpgrade criu-develUpgrade buildah-debugsourceUpgrade libslirp-debugsourceUpgrade netavarkUpgrade slirp4netns-debuginfoUpgrade runc-debuginfoUpgrade skopeoUpgrade slirp4netns-debugsourceUpgrade libslirp-develUpgrade criu-libs-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crunUpgrade critUpgrade criu-debuginfoUpgrade slirp4netnsUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade toolbox-debuginfoUpgrade runcUpgrade crun-debuginfoUpgrade skopeo-debugsourceUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade criu-libsUpgrade buildah-tests-debuginfoUpgrade buildah-testsUpgrade python3-criuUpgrade conmon-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade crun-debugsourceUpgrade criu-debugsourceUpgrade buildah-debuginfoUpgrade toolbox-testsUpgrade criuUpgrade runc-debugsourceUpgrade skopeo-debuginfoUpgrade conmon-debugsourceUpgrade libslirp-debuginfo | Mar 5, 2024 | Aug 2, 2023 |
| Suse | — | Upgrade go1.20-opensslUpgrade golang-github-lusitaniae-apache_exporterUpgrade go1.19-openssl-raceUpgrade supportutils-plugin-susemanager-clientUpgrade prometheus-blackbox_exporterUpgrade go1.19Upgrade go1.20-openssl-raceUpgrade golang-github-prometheus-alertmanagerUpgrade go1.20-openssl-docUpgrade golang-github-qubitproducts-exporter_exporterUpgrade spacecmdUpgrade prometheus-postgres_exporterUpgrade go1.20Upgrade go1.20-raceUpgrade go1.20-docUpgrade grafanaUpgrade golang-github-prometheus-node_exporterUpgrade go1.19-docUpgrade go1.19-opensslUpgrade go1.19-openssl-docUpgrade go1.19-race | Aug 4, 2023 | Aug 2, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 2, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub