Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade go-toolsetUpgrade podman-dockerUpgrade slirp4netnsUpgrade skopeo-testsUpgrade conmonUpgrade podman-gvproxyUpgrade python3-criuUpgrade libslirp-develUpgrade container-selinuxUpgrade golang-srcUpgrade libslirpUpgrade podman-testsUpgrade cockpit-podmanUpgrade criu-libsUpgrade python3-podmanUpgrade aardvark-dnsUpgrade buildahUpgrade buildah-testsUpgrade crunUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-pluginsUpgrade runcUpgrade golang-raceUpgrade netavarkUpgrade golang-docsUpgrade containers-commonUpgrade golangUpgrade udicaUpgrade toolboxUpgrade golang-binUpgrade fuse-overlayfsUpgrade podman-remoteUpgrade golang-testsUpgrade toolbox-testsUpgrade podman-catatonitUpgrade criuUpgrade podmanUpgrade critUpgrade podman-pluginsUpgrade criu-develUpgrade skopeoUpgrade golang-misc | Oct 18, 2023 | Aug 2, 2023 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 2, 2023 |
| Amazon Linux Ami 2 | — | Upgrade dockerUpgrade cri-toolsUpgrade cri-tools-debuginfoUpgrade containerd-stressUpgrade containerd-debuginfoUpgrade runc-debuginfoUpgrade amazon-ssm-agent-debuginfoUpgrade amazon-ssm-agentUpgrade nerdctl-debuginfoUpgrade amazon-cloudwatch-agentUpgrade docker-debuginfoUpgrade containerdUpgrade golang-sharedUpgrade nerdctlUpgrade golangUpgrade runcUpgrade golang-docsUpgrade golang-binUpgrade golang-srcUpgrade cni-pluginsUpgrade golang-miscUpgrade golang-testsUpgrade ecs-initUpgrade cni-plugins-debuginfo | Aug 24, 2023 | Aug 2, 2023 |
| Amazon_linux | — | Upgrade containerdUpgrade golang | Oct 7, 2023 | Aug 2, 2023 |
| Amazon_linux_2023 | — | Upgrade golang-binUpgrade amazon-ssm-agent-debugsourceUpgrade containerd-debugsourceUpgrade golang-docsUpgrade dockerUpgrade containerdUpgrade containerd-debuginfoUpgrade golang-testsUpgrade golang-miscUpgrade amazon-ssm-agent-debuginfoUpgrade containerd-stressUpgrade golangUpgrade amazon-ecr-credential-helperUpgrade docker-debuginfoUpgrade cni-plugins-debuginfoUpgrade amazon-ssm-agentUpgrade cni-pluginsUpgrade amazon-cloudwatch-agentUpgrade golang-srcUpgrade ecs-initUpgrade docker-debugsourceUpgrade cni-plugins-debugsourceUpgrade containerd-stress-debuginfoUpgrade golang-sharedUpgrade nerdctl | Feb 17, 2025 | Aug 2, 2023 |
| Centos_linux | — | Upgrade fuse-overlayfs-debuginfoUpgrade conmonUpgrade criu-libsUpgrade runc-debugsourceUpgrade golangUpgrade skopeo-debugsourceUpgrade golang-srcUpgrade libslirp-develUpgrade containers-commonUpgrade buildah-debuginfoUpgrade golang-raceUpgrade criu-debugsourceUpgrade conmon-debugsourceUpgrade runc-debuginfoUpgrade aardvark-dnsUpgrade criu-debuginfoUpgrade buildah-testsUpgrade buildah-tests-debuginfoUpgrade crun-debugsourceUpgrade fuse-overlayfsUpgrade golang-miscUpgrade podman-remote-debuginfoUpgrade libslirpUpgrade crun-debuginfoUpgrade toolboxUpgrade netavarkUpgrade buildahUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade skopeoUpgrade python3-podmanUpgrade slirp4netns-debuginfoUpgrade golang-testsUpgrade podman-catatonit-debuginfoUpgrade critUpgrade podman-gvproxy-debuginfoUpgrade podman-testsUpgrade containernetworking-plugins-debuginfoUpgrade toolbox-debuginfoUpgrade libslirp-debuginfoUpgrade golang-docsUpgrade containernetworking-plugins-debugsourceUpgrade container-selinuxUpgrade cockpit-podmanUpgrade podman-plugins-debuginfoUpgrade podman-gvproxyUpgrade podman-debuginfoUpgrade slirp4netnsUpgrade toolbox-testsUpgrade skopeo-testsUpgrade podman-dockerUpgrade udicaUpgrade runcUpgrade criuUpgrade podman-pluginsUpgrade podman-catatonitUpgrade golang-binUpgrade conmon-debuginfoUpgrade python3-criuUpgrade go-toolsetUpgrade podman-debugsourceUpgrade podmanUpgrade podman-remoteUpgrade libslirp-debugsourceUpgrade slirp4netns-debugsourceUpgrade skopeo-debuginfoUpgrade buildah-debugsourceUpgrade toolbox-debugsourceUpgrade crunUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-develUpgrade containernetworking-pluginsUpgrade criu-libs-debuginfo | Nov 1, 2023 | Aug 2, 2023 |
| Debian | — | No solution exists | May 15, 2025 | Aug 2, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jan 10, 2024 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Jan 10, 2024 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-srcUpgrade golangUpgrade golang-bin | Feb 12, 2024 | Aug 2, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jan 10, 2024 | Aug 2, 2023 |
| Oracle_linux | — | Upgrade buildahUpgrade libslirpUpgrade buildah-testsUpgrade podman-dockerUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade critUpgrade container-selinuxUpgrade udicaUpgrade skopeo-testsUpgrade criu-libsUpgrade cockpit-podmanUpgrade go-toolsetUpgrade podman-remoteUpgrade podman-gvproxyUpgrade libslirp-develUpgrade golang-docsUpgrade slirp4netnsUpgrade runcUpgrade aardvark-dnsUpgrade criu-develUpgrade golang-miscUpgrade golang-binUpgrade criuUpgrade netavarkUpgrade podman-testsUpgrade golangUpgrade golang-testsUpgrade fuse-overlayfsUpgrade podmanUpgrade podman-catatonitUpgrade golang-srcUpgrade podman-pluginsUpgrade crunUpgrade python3-podmanUpgrade skopeoUpgrade conmonUpgrade containernetworking-pluginsUpgrade golang-raceUpgrade containers-common | Oct 19, 2023 | Aug 2, 2023 |
| Redhat Openshift | — | Upgrade podmanUpgrade openshiftUpgrade microshiftUpgrade openshift-clientsUpgrade runc | Nov 16, 2023 | Aug 2, 2023 |
| Redhat_linux | — | Upgrade container-selinuxUpgrade podman-remoteUpgrade skopeo-testsUpgrade runc-debugsourceUpgrade toolbox-testsUpgrade podman-remote-debuginfoUpgrade slirp4netns-debuginfoUpgrade golang-testsUpgrade golang-docsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade conmon-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade golang-binUpgrade libslirp-debuginfoUpgrade runc-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-catatonitUpgrade criu-develUpgrade udicaUpgrade toolbox-debugsourceUpgrade buildah-testsUpgrade crun-debugsourceUpgrade aardvark-dnsUpgrade podman-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade delveUpgrade containernetworking-pluginsUpgrade podman-debugsourceUpgrade go-toolsetUpgrade runcUpgrade criu-libs-debuginfoUpgrade slirp4netns-debugsourceUpgrade python3-criuUpgrade containernetworking-plugins-debuginfoUpgrade toolbox-debuginfoUpgrade critUpgrade podmanNo solution existsUpgrade libslirp-debugsourceUpgrade criu-debugsourceUpgrade libslirp-develUpgrade fuse-overlayfs-debugsourceUpgrade podman-dockerUpgrade conmonUpgrade skopeo-debugsourceUpgrade criuUpgrade cockpit-podmanUpgrade podman-pluginsUpgrade criu-libsUpgrade toolboxUpgrade buildahUpgrade buildah-debugsourceUpgrade podman-testsUpgrade crun-debuginfoUpgrade golang-srcUpgrade containers-commonUpgrade crunUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfsUpgrade golangUpgrade delve-debuginfoUpgrade golang-raceUpgrade golang-miscUpgrade delve-debugsourceUpgrade libslirpUpgrade netavarkUpgrade criu-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade conmon-debugsourceUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade python3-podmanUpgrade buildah-debuginfoUpgrade skopeo-debuginfoUpgrade podman-gvproxyUpgrade podman-catatonit-debuginfoUpgrade skopeo | Nov 1, 2023 | Aug 2, 2023 |
| Rocky_linux | — | Upgrade crun-debuginfoUpgrade criu-debuginfoUpgrade aardvark-dnsUpgrade criu-libsUpgrade runcUpgrade toolbox-debuginfoUpgrade buildahUpgrade criuUpgrade toolbox-testsUpgrade critUpgrade runc-debugsourceUpgrade buildah-debuginfoUpgrade conmon-debuginfoUpgrade containernetworking-pluginsUpgrade criu-debugsourceUpgrade fuse-overlayfsUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade crun-debugsourceUpgrade containers-commonUpgrade libslirp-debuginfoUpgrade skopeo-debuginfoUpgrade skopeo-debugsourceUpgrade buildah-tests-debuginfoUpgrade slirp4netnsUpgrade fuse-overlayfs-debugsourceUpgrade conmon-debugsourceUpgrade buildah-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeo-testsUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade toolboxUpgrade conmonUpgrade toolbox-debugsourceUpgrade slirp4netns-debuginfoUpgrade libslirp-develUpgrade runc-debuginfoUpgrade slirp4netns-debugsourceUpgrade crunUpgrade libslirpUpgrade criu-libs-debuginfoUpgrade criu-develUpgrade containernetworking-plugins-debuginfoUpgrade netavarkUpgrade libslirp-debugsourceUpgrade buildah-debugsource | Mar 5, 2024 | Aug 2, 2023 |
| Suse | — | Upgrade go1.20Upgrade grafanaUpgrade golang-github-prometheus-node_exporterUpgrade go1.19-raceUpgrade prometheus-postgres_exporterUpgrade go1.19-opensslUpgrade go1.20-docUpgrade go1.19-docUpgrade go1.20-raceUpgrade go1.19-openssl-docUpgrade go1.19-openssl-raceUpgrade go1.20-opensslUpgrade golang-github-qubitproducts-exporter_exporterUpgrade go1.20-openssl-docUpgrade golang-github-lusitaniae-apache_exporterUpgrade go1.19Upgrade prometheus-blackbox_exporterUpgrade golang-github-prometheus-alertmanagerUpgrade go1.20-openssl-raceUpgrade supportutils-plugin-susemanager-clientUpgrade spacecmd | Aug 4, 2023 | Aug 2, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 2, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub