Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade buildah-testsUpgrade slirp4netnsUpgrade aardvark-dnsUpgrade libslirpUpgrade podman-testsUpgrade container-selinuxUpgrade go-toolsetUpgrade podman-gvproxyUpgrade cockpit-podmanUpgrade golang-srcUpgrade python3-criuUpgrade criu-libsUpgrade skopeo-testsUpgrade libslirp-develUpgrade conmonUpgrade python3-podmanUpgrade buildahUpgrade podman-dockerUpgrade critUpgrade criuUpgrade containers-commonUpgrade golang-testsUpgrade criu-develUpgrade netavarkUpgrade golang-miscUpgrade podmanUpgrade toolbox-testsUpgrade golang-binUpgrade podman-catatonitUpgrade udicaUpgrade golang-docsUpgrade oci-seccomp-bpf-hookUpgrade golangUpgrade toolboxUpgrade golang-raceUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade skopeoUpgrade podman-pluginsUpgrade fuse-overlayfsUpgrade crunUpgrade runc | Oct 18, 2023 | Aug 2, 2023 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 2, 2023 |
| Amazon Linux Ami 2 | — | Upgrade amazon-ssm-agentUpgrade cri-toolsUpgrade golang-sharedUpgrade docker-debuginfoUpgrade containerdUpgrade cri-tools-debuginfoUpgrade containerd-stressUpgrade dockerUpgrade nerdctl-debuginfoUpgrade amazon-ssm-agent-debuginfoUpgrade containerd-debuginfoUpgrade runc-debuginfoUpgrade amazon-cloudwatch-agentUpgrade golang-miscUpgrade golang-binUpgrade cni-pluginsUpgrade ecs-initUpgrade golang-testsUpgrade golang-docsUpgrade golang-srcUpgrade runcUpgrade cni-plugins-debuginfoUpgrade nerdctlUpgrade golang | Aug 24, 2023 | Aug 2, 2023 |
| Amazon_linux | — | Upgrade containerdUpgrade golang | Oct 7, 2023 | Aug 2, 2023 |
| Amazon_linux_2023 | — | Upgrade golang-sharedUpgrade docker-debugsourceUpgrade docker-debuginfoUpgrade ecs-initUpgrade containerd-stress-debuginfoUpgrade amazon-cloudwatch-agentUpgrade amazon-ssm-agentUpgrade nerdctlUpgrade cni-plugins-debugsourceUpgrade golang-srcUpgrade cni-plugins-debuginfoUpgrade cni-pluginsUpgrade amazon-ecr-credential-helperUpgrade amazon-ssm-agent-debugsourceUpgrade golang-miscUpgrade containerd-debuginfoUpgrade golang-binUpgrade golang-testsUpgrade containerd-debugsourceUpgrade golangUpgrade golang-docsUpgrade containerd-stressUpgrade containerdUpgrade dockerUpgrade amazon-ssm-agent-debuginfo | Feb 17, 2025 | Aug 2, 2023 |
| Centos_linux | — | Upgrade golang-miscUpgrade criu-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade python3-podmanUpgrade buildah-testsUpgrade conmonUpgrade buildah-tests-debuginfoUpgrade golangUpgrade runc-debuginfoUpgrade runc-debugsourceUpgrade containers-commonUpgrade fuse-overlayfsUpgrade conmon-debugsourceUpgrade buildahUpgrade golang-srcUpgrade skopeo-debugsourceUpgrade crun-debugsourceUpgrade aardvark-dnsUpgrade fuse-overlayfs-debuginfoUpgrade golang-raceUpgrade libslirpUpgrade toolboxUpgrade crun-debuginfoUpgrade skopeoUpgrade netavarkUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libsUpgrade podman-remote-debuginfoUpgrade buildah-debuginfoUpgrade libslirp-develUpgrade criu-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade golang-testsUpgrade toolbox-debuginfoUpgrade criu-libs-debuginfoUpgrade critUpgrade toolbox-testsUpgrade toolbox-debugsourceUpgrade podman-pluginsUpgrade podman-catatonitUpgrade slirp4netns-debuginfoUpgrade skopeo-debuginfoUpgrade udicaUpgrade runcUpgrade criuUpgrade podman-debuginfoUpgrade libslirp-debuginfoUpgrade golang-docsUpgrade containernetworking-plugins-debugsourceUpgrade container-selinuxUpgrade cockpit-podmanUpgrade podman-plugins-debuginfoUpgrade podman-gvproxyUpgrade podmanUpgrade skopeo-testsUpgrade podman-gvproxy-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade go-toolsetUpgrade criu-develUpgrade podman-testsUpgrade podman-remoteUpgrade libslirp-debugsourceUpgrade slirp4netnsUpgrade podman-dockerUpgrade slirp4netns-debugsourceUpgrade containernetworking-pluginsUpgrade golang-binUpgrade conmon-debuginfoUpgrade python3-criuUpgrade podman-debugsourceUpgrade podman-catatonit-debuginfoUpgrade crun | Nov 1, 2023 | Aug 2, 2023 |
| Debian | — | No solution exists | May 15, 2025 | Aug 2, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jan 10, 2024 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Jan 10, 2024 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golangUpgrade golang-srcUpgrade golang-bin | Feb 12, 2024 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Jan 10, 2024 | Aug 2, 2023 |
| Oracle_linux | — | Upgrade podmanUpgrade golang-raceUpgrade podman-pluginsUpgrade golang-miscUpgrade golang-binUpgrade netavarkUpgrade crunUpgrade golang-testsUpgrade python3-podmanUpgrade golang-srcUpgrade podman-catatonitUpgrade containernetworking-pluginsUpgrade podman-testsUpgrade conmonUpgrade fuse-overlayfsUpgrade golangUpgrade skopeoUpgrade containers-commonUpgrade criuUpgrade critUpgrade buildah-testsUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade libslirp-develUpgrade container-selinuxUpgrade udicaUpgrade skopeo-testsUpgrade criu-libsUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade golang-docsUpgrade python3-criuUpgrade podman-remoteUpgrade podman-dockerUpgrade oci-seccomp-bpf-hookUpgrade libslirpUpgrade runcUpgrade go-toolsetUpgrade buildahUpgrade criu-devel | Oct 19, 2023 | Aug 2, 2023 |
| Redhat Openshift | — | Upgrade openshiftUpgrade podmanUpgrade microshiftUpgrade openshift-clientsUpgrade runc | Nov 16, 2023 | Aug 2, 2023 |
| Redhat_linux | — | Upgrade criu-develUpgrade podman-plugins-debuginfoUpgrade golang-docsUpgrade runc-debugsourceUpgrade skopeo-testsUpgrade libslirp-debuginfoUpgrade slirp4netns-debugsourceUpgrade delveUpgrade container-selinuxUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-libs-debuginfoNo solution existsUpgrade libslirp-debugsourceUpgrade runcUpgrade podmanUpgrade golang-testsUpgrade toolbox-debuginfoUpgrade toolbox-debugsourceUpgrade python3-criuUpgrade crun-debugsourceUpgrade podman-debugsourceUpgrade aardvark-dnsUpgrade critUpgrade runc-debuginfoUpgrade criu-debugsourceUpgrade podman-debuginfoUpgrade udicaUpgrade golang-binUpgrade go-toolsetUpgrade toolbox-testsUpgrade podman-gvproxy-debuginfoUpgrade buildah-testsUpgrade podman-remote-debuginfoUpgrade conmon-debuginfoUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade containernetworking-plugins-debuginfoUpgrade podman-catatonitUpgrade skopeoUpgrade criu-debuginfoUpgrade golangUpgrade criu-libsUpgrade skopeo-debugsourceUpgrade golang-miscUpgrade containernetworking-plugins-debugsourceUpgrade podman-pluginsUpgrade conmon-debugsourceUpgrade libslirpUpgrade delve-debugsourceUpgrade python3-podmanUpgrade fuse-overlayfs-debugsourceUpgrade containers-commonUpgrade cockpit-podmanUpgrade crunUpgrade buildah-tests-debuginfoUpgrade slirp4netnsUpgrade golang-srcUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debuginfoUpgrade podman-testsUpgrade buildah-debugsourceUpgrade netavarkUpgrade podman-gvproxyUpgrade criuUpgrade delve-debuginfoUpgrade libslirp-develUpgrade crun-debuginfoUpgrade buildahUpgrade podman-catatonit-debuginfoUpgrade buildah-debuginfoUpgrade conmonUpgrade podman-dockerUpgrade skopeo-debuginfoUpgrade golang-raceUpgrade toolbox | Nov 1, 2023 | Aug 2, 2023 |
| Rocky_linux | — | Upgrade crun-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade conmon-debuginfoUpgrade criu-debugsourceUpgrade criu-debuginfoUpgrade runc-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade toolbox-testsUpgrade buildah-debuginfoUpgrade conmon-debugsourceUpgrade containernetworking-pluginsUpgrade libslirp-debuginfoUpgrade containers-commonUpgrade buildah-testsUpgrade criu-libsUpgrade buildah-tests-debuginfoUpgrade skopeo-debugsourceUpgrade runcUpgrade critUpgrade skopeo-debuginfoUpgrade buildahUpgrade fuse-overlayfsUpgrade python3-criuUpgrade toolbox-debuginfoUpgrade slirp4netnsUpgrade aardvark-dnsUpgrade crun-debugsourceUpgrade criuUpgrade buildah-debugsourceUpgrade netavarkUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-develUpgrade crunUpgrade toolboxUpgrade conmonUpgrade skopeo-testsUpgrade fuse-overlayfs-debuginfoUpgrade slirp4netns-debuginfoUpgrade toolbox-debugsourceUpgrade criu-libs-debuginfoUpgrade runc-debuginfoUpgrade skopeoUpgrade libslirp-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirpUpgrade criu-develUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-plugins-debugsource | Mar 5, 2024 | Aug 2, 2023 |
| Suse | — | Upgrade go1.20-raceUpgrade golang-github-prometheus-node_exporterUpgrade grafanaUpgrade prometheus-postgres_exporterUpgrade go1.19-openssl-docUpgrade go1.20Upgrade go1.20-docUpgrade go1.19-raceUpgrade go1.19-opensslUpgrade go1.19-docUpgrade go1.19Upgrade spacecmdUpgrade go1.20-openssl-docUpgrade prometheus-blackbox_exporterUpgrade golang-github-qubitproducts-exporter_exporterUpgrade go1.20-opensslUpgrade go1.19-openssl-raceUpgrade go1.20-openssl-raceUpgrade supportutils-plugin-susemanager-clientUpgrade golang-github-lusitaniae-apache_exporterUpgrade golang-github-prometheus-alertmanager | Aug 4, 2023 | Aug 2, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 2, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub