Skip to content
Fencer Vulns
medium 5.3

CVE-2023-29409 json

Large RSA keys can cause high CPU usage in crypto/tls

published 2023-08-02 3 y ago modified 2026-09-08 2 mo ago also BIT-golang-2023-29409 , EUVD-2023-32978 , GO-2023-1987

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 75%
public exploits
0
none known

Summary

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.

Patch / fix

  • bitnami golang 1.19.12, 1.20.7
  • go stdlib 1.19.12, 1.20.7, 1.21.0-rc.4
  • Go standard library crypto/tls 1.19.12, 1.20.7, 1.21.0-rc.4
  • delve RHEL 8 1.9.1-1.module+el8.8.0+16778+5fbb74f5
  • golang RHEL 8 1.19.13-1.module+el8.8.0+20373+d9cd605c
  • go-toolset RHEL 8 1.19.13-1.module+el8.8.0+20380+7171fefb
  • golang-bin RHEL 8 1.19.13-1.module+el8.8.0+20373+d9cd605c
  • golang-src RHEL 8 1.19.13-1.module+el8.8.0+20373+d9cd605c
  • golang-misc RHEL 8 1.19.13-1.module+el8.8.0+20373+d9cd605c
  • golang-race RHEL 8 1.19.13-1.module+el8.8.0+20373+d9cd605c
  • golang-tests RHEL 8 1.19.13-1.module+el8.8.0+20373+d9cd605c

red hat advisories RHSA-2023:5721RHSA-2024:2988RHSA-2024:0121RHSA-2023:6840RHSA-2023:6298RHSA-2023:5964

  • golang-github-prometheus-alertmanager SLE Module for Package Hub 15 SP5, openSUSE Leap 15.5, openSUSE Leap 15.4 +3 more 0.23.0-150100.4.16.2
  • golang-github-prometheus-node_exporter SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +15 more 1.5.0-150100.3.26.2
  • grafana SLE Module for Package Hub 15 SP5, SLE Module for Package Hub 15 SP4, openSUSE Leap 15.5 +1 more 9.5.5-150200.3.47.1
  • release-notes-susemanager Manager Server 4.3 4.3.8-150400.3.77.1
  • release-notes-susemanager-proxy Manager Proxy 4.3 4.3.8-150400.3.61.2
  • spacecmd Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS, EL-9:Update:Products:ManagerTools:Update 4.3.23-1.18.2
  • scap-security-guide Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS, EL-9:Update:Products:ManagerTools:Update 0.1.69-1.12.2
  • prometheus-postgres_exporter Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS, EL-9:Update:Products:ManagerTools:Update 0.10.1-1.9.2

suse advisories SUSE-SU-2023:3888-1SUSE-SU-2023:3886-1SUSE-SU-2023:3885-1SUSE-EL-9-CLIENT-TOOLS-2023-3875SUSE-SU-2023:3875-1SUSE-SU-2023:3868-1

  • go1.19 openSUSE Tumbleweed 1.19.12-1.1
  • go1.20 openSUSE Tumbleweed 1.20.7-1.1

opensuse advisories openSUSE-SU-2024:13093-1openSUSE-SU-2024:13094-1

  • crit AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crit AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crun AlmaLinux 8 1.8.7-1.module_el8.9.0+3683+33eb0feb
  • runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3627+db8ec155
  • runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3687+dcd7ef8f
  • udica AlmaLinux 8 0.2.6-4.module_el8.9.0+3627+db8ec155

almalinux advisories ALSA-2024:0121ALSA-2023:7762ALSA-2023:7763ALSA-2023:7764ALSA-2023:7765ALSA-2023:7766

  • criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
  • runc Rocky Linux 8 1:1.1.5-2.module+el8.9.0+1445+07728297
  • udica Rocky Linux 8 0.2.6-4.module+el8.9.0+1445+07728297
  • conmon Rocky Linux 8 2:2.1.4-2.module+el8.9.0+1445+07728297
  • skopeo Rocky Linux 8 2:1.6.2-9.module+el8.9.0+1578+aa900b44
  • buildah Rocky Linux 8 1:1.24.6-7.module+el8.9.0+1445+07728297
  • libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297
  • slirp4netns Rocky Linux 8 1.1.8-3.module+el8.9.0+1445+07728297

rocky linux advisories RLSA-2024:0121RLSA-2024:2988RLSA-2023:5738

  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 1.20.7-r0

alpine advisories ALPINE-CVE-2023-29409

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0, Azure Linux 3.0 1.20.7-1
  • msft-golang CBL-Mariner 2.0 1.20.7-1
  • golang CBL-Mariner 2.0 1.21.6-1

azure linux advisories AZL-27812AZL-27814AZL-37302AZL-37344AZL-52881

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-29409 updated cvss 5.3

golang: crypto/tls: slow verification of certificate chains containing large RSA keys

  • Red Hat mirror registry for Red Hat OpenShift mirror-registry-container Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator Red Hat OpenShift Developer Tools and Services helm, ocp-tools-4/jenkins-rhel8 Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat OpenShift Service Mesh 2 openshift-golang-builder-container Red Hat 3scale API Management Platform 2 3scale-amp26/3scale-operator
    +1 more products
    Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/subctl-rhel9
    affected: no fix available
  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Application Interconnect 1.0 skupper-cli Red Hat build of Apicurio Registry 2 openshift-service-mesh/istio-rhel9-operator Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: no fix available
  • Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-cnf, redhat-certification-preflight Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-cnf, redhat-certification-preflight
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +12 more Red Hat Enterprise Linux 9 butane, git-lfs, grafana, toolbox, ignition, ignition-edge, +8 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 conmon, skopeo, buildah, ignition, skopeo-tests, buildah-tests, +5 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Data Science (RHODS) rhods/odh-mm-rest-proxy-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/udi-rhel8 Red Hat OpenShift distributed tracing 2 rhosdt/tempo-rhel8 Red Hat OpenShift GitOps openshift-gitops-kam, openshift-gitops-1/gitops-rhel8
    affected: no fix available
show 16 more
  • Red Hat OpenShift on AWS rosa
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 kubevirt, openshift-golang-builder-container
    affected: no fix available
  • Red Hat OpenStack Platform 16.2 golang-github-infrawatch-apputils Red Hat OpenStack Platform 17.0 collectd-libpod-stats, golang-github-infrawatch-apputils Red Hat OpenStack Platform 17.1 golang-github-infrawatch-apputils
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 18.0 collectd-libpod-stats, rhoso-operators/ovn-rhel9-operator
    affected: no fix available
  • Red Hat Storage 3 golang, heketi, golang-bin, golang-src, golang-misc, golang-tests, +3 more
    affected: no fix planned “Out of support scope”
  • Red Hat Web Terminal web-terminal/web-terminal-rhel9-operator
    affected: no fix available “Fix deferred”
  • Red Hat Self Node Remediation Operator workload-availability/self-node-remediation-rhel8-operator
    affected: no fix available
  • Red Hat Cert Manager support for Red Hat OpenShift release cert-manager/cert-manager-operator-rhel9 v1.11.5-5
    fixed: vendor fix RHSA-2023:6279
  • Red Hat Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-rhel8-operator 2.3.1-11
    fixed: vendor fix RHSA-2023:6031
  • Red Hat LVMS 4.14 for RHEL 9 lvms4/topolvm-rhel9 v4.14.1-2, lvms4/lvms-rhel9-operator v4.14.1-3, lvms4/lvms-operator-bundle v4.14.1-4, lvms4/lvms-must-gather-rhel9 v4.14.1-3
    fixed: vendor fix RHBA-2023:6863
  • Red Hat Migration Toolkit for Virtualization 2.4 migration-toolkit-virtualization/mtv-rhel8-operator 2.4.3-3
    fixed: vendor fix RHBA-2023:6109
  • Red Hat MTA 6.2 for RHEL 8 mta/mta-ui-rhel9 6.2.2-2, mta/mta-hub-rhel9 6.2.2-2, mta/mta-rhel8-operator 6.2.2-3, mta/mta-operator-bundle 6.2.2-5, mta/mta-pathfinder-rhel9 6.2.2-2, mta/mta-windup-addon-rhel9 6.2.2-3
    fixed: vendor fix RHSA-2024:1027
  • Red Hat NETOBSERV 1.4 for RHEL 9 network-observability/network-observability-rhel9-operator v1.4.0-51
    fixed: vendor fix RHSA-2023:5974
  • Red Hat OpenShift API for Data Protection 1.1 oadp/oadp-velero-rhel8 1.1.7-6
    fixed: vendor fix RHSA-2023:6115
  • Red Hat OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8 v1.1-37
    fixed: vendor fix RHSA-2023:5933
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor 1.4.2-1.el8ap, receptorctl 1.4.2-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 receptor 1.4.2-1.el9ap, receptorctl 1.4.2-1.el9ap
    fixed: vendor fix RHSA-2023:5805

13 more fixed, 21 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-137-07 updated cvss 5.3

Siemens SIMATIC RTLS Locating Manager

  • Siemens SIMATIC RTLS Locating Manager (6GT2780-0DA00) <V3.0.1.1 Siemens SIMATIC RTLS Locating Manager (6GT2780-0DA10) <V3.0.1.1 Siemens SIMATIC RTLS Locating Manager (6GT2780-0DA20) <V3.0.1.1 Siemens SIMATIC RTLS Locating Manager (6GT2780-0DA30) <V3.0.1.1 Siemens SIMATIC RTLS Locating Manager (6GT2780-1EA10) <V3.0.1.1 Siemens SIMATIC RTLS Locating Manager (6GT2780-1EA20) <V3.0.1.1
    +1 more products
    Siemens SIMATIC RTLS Locating Manager (6GT2780-1EA30) <V3.0.1.1
    affected: fixed in V3.0.1.1, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-046-11 updated cvss 5.3

Siemens SCALANCE XCM-/XRM-300

  • Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4
    +5 more products
    Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4
    affected: fixed in V2.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.60% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
OSV 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.19.12
>=1.20.0, <1.20.7
1.19.12
1.20.7
go stdlib
<1.19.12
>=1.20.0-0, <1.20.7
>=1.21.0-0, <1.21.0-rc.4
1.19.12
1.20.7
1.21.0-rc.4

Affected products

  • Go standard library crypto/tls

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.