Skip to content
Fencer Vulns
low 3.1

CVE-2022-30629 json

Session tickets lack random ticket_age_add in crypto/tls

published 2022-07-28 4 y ago modified 2026-09-08 2 mo ago also BIT-golang-2022-30629 , EUVD-2022-52460 , GO-2022-0531

cvss
3.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

Patch / fix

  • bitnami golang 1.17.11, 1.18.3
  • go stdlib 1.17.11, 1.18.3
  • Go standard library crypto/tls 1.17.11, 1.18.3
  • golang-1.13 Ubuntu 20.04 LTS 1.13.8-1ubuntu1.2
  • golang-1.13 Ubuntu 22.04 LTS 1.13.8-1ubuntu2.22.04.2
  • golang-1.16 Ubuntu 20.04 LTS 1.16.2-0ubuntu1~20.04.1
  • golang-1.18 Ubuntu 18.04 LTS 1.18.1-1ubuntu1~18.04.4
  • golang-1.18 Ubuntu 20.04 LTS 1.18.1-1ubuntu1~20.04.2
  • golang-1.18 Ubuntu 22.04 LTS 1.18.1-1ubuntu1.1
  • golang-1.13 Ubuntu Pro 16.04 LTS 1.13.8-1ubuntu1~16.04.3+esm3
  • golang-1.13 Ubuntu Pro 18.04 LTS 1.13.8-1ubuntu1~18.04.4+esm1

ubuntu advisories UBUNTU-CVE-2022-30629

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • crit RHEL 8 3.15-3.module+el8.8.0+18060+3f21f2cc
  • criu RHEL 8 3.15-3.module+el8.8.0+18060+3f21f2cc
  • crun RHEL 8 1.8.1-2.module+el8.8.0+18418+f0e540fe
  • runc RHEL 8 1:1.1.4-1.module+el8.8.0+18060+3f21f2cc
  • udica RHEL 8 0.2.6-20.module+el8.8.0+18060+3f21f2cc
  • conmon RHEL 8 3:2.1.6-1.module+el8.8.0+18098+9b44df5f
  • podman RHEL 8 3:4.4.1-8.module+el8.8.0+18438+15d3aa65
  • skopeo RHEL 8 2:1.11.2-0.2.module+el8.8.0+18251+ad5b274c

red hat advisories RHSA-2023:2758RHSA-2022:5775RHSA-2023:3914RHSA-2023:2367RHSA-2023:2282RHSA-2023:2253

  • go1.18-openssl SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +6 more 1.18.10.1-150000.1.9.1
  • go1.18 SLE Module for Development Tools 15 SP4, SLE Module for Development Tools 15 SP3, openSUSE Leap 15.4 +1 more 1.18.3-150000.1.20.1
  • go1.17 SLE Module for Development Tools 15 SP4, SLE Module for Development Tools 15 SP3, openSUSE Leap 15.4 +1 more 1.17.11-150000.1.37.1

suse advisories SUSE-SU-2023:2312-1SUSE-SU-2022:2005-1SUSE-SU-2022:2004-1

  • go1.17 openSUSE Tumbleweed 1.17.11-1.1
  • go1.18 openSUSE Tumbleweed 1.18.3-1.1

opensuse advisories openSUSE-SU-2024:12123-1openSUSE-SU-2024:12124-1

  • crit AlmaLinux 8 3.15-3.module_el8.7.0+3407+95aa0ca9
  • criu AlmaLinux 8 3.15-3.module_el8.7.0+3407+95aa0ca9
  • crun AlmaLinux 8 1.8.1-2.module_el8.8.0+3568+e8578284
  • runc AlmaLinux 8 1:1.1.4-1.module_el8.7.0+3407+95aa0ca9
  • udica AlmaLinux 8 0.2.6-20.module_el8.8.0+3470+252b1910
  • conmon AlmaLinux 8 3:2.1.6-1.module_el8.8.0+3470+252b1910
  • podman AlmaLinux 8 3:4.4.1-8.module_el8.8.0+3568+e8578284
  • skopeo AlmaLinux 8 2:1.11.2-0.2.module_el8.8.0+3470+252b1910

almalinux advisories ALSA-2023:2758ALSA-2023:2253ALSA-2023:2282ALSA-2023:2283ALSA-2023:2367

  • criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
  • libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297
  • golang Rocky Linux 9 1.17.12-1.el9_0
  • go-toolset Rocky Linux 9 1.17.12-1.el9_0
  • delve Rocky Linux 8 1.7.2-1.module+el8.6.0+824+8e984c20
  • golang Rocky Linux 8 1.17.12-1.module+el8.6.0+993+4fde2340
  • go-toolset Rocky Linux 8 1.17.12-1.module+el8.6.0+993+4fde2340

rocky linux advisories RLSA-2023:2758RLSA-2022:5799RLSA-2022:5775

  • go Alpine 3.16 1.18.4-r0

alpine advisories ALPINE-CVE-2022-30629

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0 1.18.5-1

azure linux advisories AZL-10550

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-30629 updated cvss 3.1

golang: crypto/tls: session tickets lack random ticket_age_add

  • Red Hat Migration Toolkit for Containers cpma
    affected: no fix available “Fix deferred”
  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-controller-rhel9, migration-toolkit-virtualization/mtv-must-gather-api-rhel8 Red Hat mirror registry for Red Hat OpenShift mirror-registry-container Red Hat OpenShift Developer Tools and Services odo, helm Red Hat OpenShift Pipelines openshift-pipelines-client
    affected: no fix available
  • Red Hat OpenShift Serverless openshift-serverless-1/openshift-serverless-1-eventing-kafka-channel-webhook-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Service Mesh 2.0 ior, kiali, servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-proxy, +7 more
    affected: no fix available
  • Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana, openshift-service-mesh/kiali-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat 3scale API Management Platform 2 3scale-amp26/3scale-operator, 3scale-amp2/apicast-rhel9-operator
    affected: no fix available
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/work-rhel8, rhacm2/search-rhel8, rhacm2/subctl-rhel9, rhacm2/thanos-rhel7, rhacm2/volsync-rhel8, rhacm2/placement-rhel8, +72 more Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-scanner-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat Ansible Automation Platform 1.2 helm, openshift-clients Red Hat Ansible Automation Platform 2 receptor, openshift-clients, rhc-catalog-worker Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: no fix available
show 20 more
  • Red Hat Enterprise Linux 7 podman, skopeo, buildah, containernetworking-plugins
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 runc, conmon, podman, skopeo, buildah, grafana, +27 more Red Hat Enterprise Linux 9 runc, butane, grafana, toolbox, ignition, grafana-pcp, +5 more Red Hat OpenShift Container Platform 4 runc, openshift, prometheus-promu, openshift-clients, openshift-kubelet, openshift-hyperkube, +6 more
    affected: no fix available “Fix deferred”
  • Red Hat Openshift Container Storage 4 mcg, ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, odf4/ocs-rhel9-operator, ocs4/rook-ceph-rhel8-operator, ocs4/volume-replication-rhel8-operator
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift GitOps openshift-gitops-kam, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/kam-delivery-rhel8, openshift-gitops-1/applicationset-rhel8, openshift-gitops-1/gitops-operator-bundle, +1 more Red Hat OpenShift on AWS rosa
    affected: no fix available
  • Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Virtualization 2 virt-api-container, kubemacpool-container, bridge-marker-container, ovs-cni-marker-container, kubevirt-vmware-container, virt-cdi-cloner-container, +10 more Red Hat OpenShift Virtualization 4 kubevirt-velero-plugin-container, container-native-virtualization/kubemacpool, container-native-virtualization/bridge-marker, container-native-virtualization/ovs-cni-marker, container-native-virtualization/ovs-cni-plugin, container-native-virtualization/kubevirt-vmware, +6 more
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 16.2 collectd-libpod-stats, rhosp-rhel8/osp-director-operator
    affected: no fix available “Fix deferred”
  • Red Hat Quay 3 quay/quay-rhel8, quay/clair-rhel8, quay/quay-builder-rhel8, quay/quay-operator-rhel8, quay/quay-openshift-bridge-rhel8-operator, quay/quay-container-security-operator-rhel8
    affected: no fix available
  • Red Hat Software Collections rh-git227-git-lfs
    affected: no fix available “Fix deferred”
  • Red Hat Web Terminal web-terminal-exec-container, web-terminal/web-terminal-rhel9-operator
    affected: no fix available
  • Red Hat Service Telemetry Framework 1.3 for RHEL 8 stf/sg-core-rhel8 Red Hat Service Telemetry Framework 1.4 for RHEL 8 stf/sg-core-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat CNV 4.12 for RHEL 7 kubevirt 4.12.0-1057.el7, kubevirt-virtctl 4.12.0-1057.el7, kubevirt-virtctl-redistributable 4.12.0-1057.el7 Red Hat CNV 4.12 for RHEL 8 kubevirt 4.12.0-1057.el8, kubevirt-virtctl 4.12.0-1057.el8, kubevirt-virtctl-redistributable 4.12.0-1057.el8, container-native-virtualization/virt-cdi-cloner v4.12.0-72, container-native-virtualization/libguestfs-tools v4.12.0-255, container-native-virtualization/hostpath-csi-driver v4.12.0-30, +3 more
    fixed: vendor fix RHSA-2023:0407
  • Red Hat OpenShift API for Data Protection 1.0 oadp/oadp-velero-rhel8 1.0.4-6, oadp/oadp-registry-rhel8 1.0.4-6, oadp/oadp-rhel8-operator 1.0.4-5, oadp/oadp-operator-bundle 1.0.4-17, oadp/oadp-mustgather-rhel8 1.0.4-17, oadp/oadp-velero-plugin-rhel8 1.0.4-5, +6 more
    fixed: vendor fix RHSA-2022:6430
  • Red Hat OpenShift API for Data Protection 1.1 oadp/oadp-velero-rhel8 1.1.0-27, oadp/oadp-rhel8-operator 1.1.0-50, oadp/oadp-mustgather-rhel8 1.1.0-63, oadp/oadp-velero-plugin-rhel8 1.1.0-20, oadp/oadp-velero-plugin-for-aws-rhel8 1.1.0-17, oadp/oadp-velero-plugin-for-csi-rhel8 1.1.0-25, +5 more
    fixed: vendor fix RHSA-2022:6290
  • Red Hat OpenShift Service Mesh 2.1 servicemesh 2.1.5-1.el8, servicemesh-cni 2.1.5-1.el8, servicemesh-proxy 2.1.5-1.el8, servicemesh-operator 2.1.5-1.el8, servicemesh-ratelimit 2.1.5-1.el8, servicemesh-proxy-wasm 2.1.5-1.el8, +3 more
    fixed: vendor fix RHSA-2022:6277
  • Red Hat OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8 v1.1-11
    fixed: vendor fix RHSA-2022:6152
  • Red Hat Ceph Storage 6.1 Tools rhceph/rhceph-6-dashboard-rhel9 6-75
    fixed: vendor fix RHSA-2023:3642
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.17 1.17.12-1.el7_9, go-toolset-1.17-build 1.17.12-1.el7_9, go-toolset-1.17-golang 1.17.12-1.el7_9, go-toolset-1.17-runtime 1.17.12-1.el7_9, go-toolset-1.17-scldevel 1.17.12-1.el7_9, go-toolset-1.17-golang-bin 1.17.12-1.el7_9, +4 more
    fixed: vendor fix RHSA-2022:5866
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.15-3.module+el8.8.0+18060+3f21f2cc, criu 3.15-3.module+el8.8.0+18060+3f21f2cc, crun 1.8.1-2.module+el8.8.0+18418+f0e540fe, runc 1.1.4-1.module+el8.8.0+18060+3f21f2cc, delve 1.7.2-1.module+el8.6.0+12972+ebab5911, conmon 2.1.6-1.module+el8.8.0+18098+9b44df5f, +35 more
    fixed: vendor fix RHSA-2022:5775
  • Red Hat Enterprise Linux AppStream (v. 9) podman 4.4.1-3.el9, buildah 1.29.1-1.el9, skopeo 1.11.2-0.1.el9, golang 1.17.12-1.el9_0, podman-tests 4.4.1-3.el9, podman-docker 4.4.1-3.el9, +12 more
    fixed: vendor fix RHSA-2022:5799

7 more fixed, 13 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
8 mo ago

Exploit prediction

1.21% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • go.dev https://go.dev/issue/52814 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
NVD 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CNA 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
OSV 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.17.11
>=1.18.0, <1.18.3
1.17.11
1.18.3
go stdlib
<1.17.11
>=1.18.0-0, <1.18.3
1.17.11
1.18.3

Affected products

  • Go standard library crypto/tls

Classification

Weakness
  • CWE-330 Use of Insufficiently Random Values

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.