CVE-2022-30629

Session tickets lack random ticket_age_add in crypto/tls

State: Published
Severity: 3.1 Low
Published: Aug 9, 2022
Updated: Mar 6, 2026
Reserved: May 12, 2022

Description

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

Scores

CVSS	Score	Vector	Source
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
crypto/tlsGo standard library	before 1.17.11Affected 1.18.0-0 to before 1.18.3Affected

References

https://go.dev/cl/405994
https://go.googlesource.com/go/+/fe4de36198794c447fbd9d7cc2d7199a506c76a5
https://go.dev/issue/52814
https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ
https://pkg.go.dev/vuln/GO-2022-0531

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.