NVD Vulnerability Detail

CVE-2023-29409

Summary	Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.
Publication Date	Aug. 3, 2023, 5:15 a.m.
Registration Date	Aug. 3, 2023, 10 a.m.
Last Update	Nov. 21, 2024, 4:57 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	https://go.dev/cl/515257	Patch
2	https://go.dev/issue/61460	Issue Tracking Patch Vendor Advisory
3	https://groups.google.com/g/golang-announce/c/X0b6CsSAaYI/m/Efv5DbZ9AwAJ	Mailing List Vendor Advisory
4	https://pkg.go.dev/vuln/GO-2023-1987	Patch Vendor Advisory
5	https://security.gentoo.org/glsa/202311-09
6	https://security.netapp.com/advisory/ntap-20230831-0010/
7	https://go.dev/cl/515257	Patch
8	https://security.netapp.com/advisory/ntap-20230831-0010/
9	https://security.gentoo.org/glsa/202311-09
10	https://pkg.go.dev/vuln/GO-2023-1987	Patch Vendor Advisory
11	https://groups.google.com/g/golang-announce/c/X0b6CsSAaYI/m/Efv5DbZ9AwAJ	Mailing List Vendor Advisory
12	https://go.dev/issue/61460	Issue Tracking Patch Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-400	リソースの枯渇	https://cwe.mitre.org/data/definitions/400.html

JVN Vulnerability Information

The Go Project の Go におけるリソースの枯渇に関する脆弱性

Title	The Go Project の Go におけるリソースの枯渇に関する脆弱性
Summary	The Go Project の Go には、リソースの枯渇に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。
Publication Date	Aug. 2, 2023, midnight
Registration Date	Jan. 19, 2024, 1:49 p.m.
Last Update	Jan. 19, 2024, 1:49 p.m.

Affected System

The Go Project

Go 1.19.12 未満

Go 1.20.0 以上 1.20.7 未満

Go 1.21.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2023-29409	https://www.cve.org/CVERecord?id=CVE-2023-29409
National Vulnerability Database (NVD)
2	CVE-2023-29409	https://nvd.nist.gov/vuln/detail/CVE-2023-29409

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-400	https://cwe.mitre.org/data/definitions/400.html

その他

No	Name	URL
関連文書
1	go.dev (cl/515257)	https://go.dev/cl/515257
2	go.dev (issue/61460)	https://go.dev/issue/61460
3	groups.google.com (Efv5DbZ9AwAJ)	https://groups.google.com/g/golang-announce/c/X0b6CsSAaYI/m/Efv5DbZ9AwAJ
4	pkg.go.dev (GO-2023-1987)	https://pkg.go.dev/vuln/GO-2023-1987
5	security.gentoo.org (202311-09)	https://security.gentoo.org/glsa/202311-09
6	security.netapp.com (ntap-20230831-0010)	https://security.netapp.com/advisory/ntap-20230831-0010/

Change Log

No	Changed Details	Date of change
1	[2024年01月19日] 掲載	Jan. 19, 2024, 1:49 p.m.