Skip to content
Fencer Vulns
high 7.5

CVE-2023-45287 json

Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

published 2023-12-05 2 y ago modified 2026-09-08 2 mo ago also BIT-golang-2023-45287 , EUVD-2023-49587 , GO-2023-2375

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 69%
public exploits
0
none known

Summary

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels.

Patch / fix

  • bitnami golang 1.20.0
  • go stdlib 1.20.0
  • Go standard library crypto/tls 1.20.0
  • crit RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
  • criu RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
  • crun RHEL 8 1.14.3-2.module+el8.10.0+21340+c6c7475a
  • runc RHEL 8 1:1.1.12-1.module+el8.10.0+21251+62b7388c
  • udica RHEL 8 0.2.6-20.module+el8.9.0+20326+387084d0
  • conmon RHEL 8 3:2.1.10-1.module+el8.10.0+21077+98b84d8a
  • podman RHEL 8 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
  • skopeo RHEL 8 2:1.14.3-0.1.module+el8.10.0+21251+62b7388c

red hat advisories RHSA-2024:2988RHSA-2024:0748RHSA-2023:7201RHSA-2023:7200RHSA-2024:4429RHSA-2024:2245

  • runc AlmaLinux 9 4:1.1.12-2.el9
  • podman AlmaLinux 9 2:4.9.4-0.1.el9
  • podman-tests AlmaLinux 9 2:4.9.4-0.1.el9
  • podman-docker AlmaLinux 9 2:4.9.4-0.1.el9
  • podman-remote AlmaLinux 9 2:4.9.4-0.1.el9
  • podman-plugins AlmaLinux 9 2:4.9.4-0.1.el9
  • skopeo AlmaLinux 9 2:1.14.3-0.1.el9
  • skopeo-tests AlmaLinux 9 2:1.14.3-0.1.el9

almalinux advisories ALSA-2024:2180ALSA-2024:2193ALSA-2024:2239ALSA-2024:2245ALSA-2024:2272ALSA-2024:0748

  • criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
  • runc Rocky Linux 8 1:1.1.12-1.module+el8.10.0+1815+5fe7415e
  • runc Rocky Linux 8 1:1.1.12-1.module+el8.10.0+1825+623b0c20
  • udica Rocky Linux 8 0.2.6-4.module+el8.9.0+1445+07728297
  • conmon Rocky Linux 8 2:2.1.4-2.module+el8.9.0+1445+07728297
  • skopeo Rocky Linux 8 2:1.6.2-9.module+el8.9.0+1578+aa900b44
  • buildah Rocky Linux 8 1:1.24.6-7.module+el8.9.0+1445+07728297
  • libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297

rocky linux advisories RLSA-2024:0748RLSA-2024:2988

  • golang CBL-Mariner 2.0, Azure Linux 3.0 1.20.0-1
  • msft-golang CBL-Mariner 2.0 1.20.0-1
  • golang CBL-Mariner 2.0 1.21.6-1

azure linux advisories AZL-32100AZL-32123AZL-34764AZL-37310AZL-37380

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-45287 updated cvss 7.5

golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges.

  • Red Hat Cryostat 2 cryostat/cryostat-rhel8-operator Red Hat Logical Volume Manager Storage lvms4/topolvm-rhel9
    affected: workaround, no fix available “No current mitigation is available for this vulnerability.”
  • Red Hat Migration Toolkit for Applications 6 mta/mta-hub-rhel8
    affected: workaround, no fix planned “No current mitigation is available for this vulnerability.”
  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-api-rhel9 Red Hat mirror registry for Red Hat OpenShift mirror-registry-container
    affected: workaround, no fix available “No current mitigation is available for this vulnerability.”
  • Red Hat NBDE Tang Server tang-operator-container
    affected: workaround, no fix planned “No current mitigation is available for this vulnerability.”
  • Red Hat OpenShift Developer Tools and Services helm, ocp-tools-4/jenkins-rhel8
    affected: workaround, no fix available, no fix planned “No current mitigation is available for this vulnerability.”
  • Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat Power monitoring for Red Hat OpenShift kepler-container Red Hat 3scale API Management Platform 2 3scale-amp26/3scale-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/subctl-rhel9 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8
    +4 more products
    Red Hat Ansible Automation Platform 2 aap-cloud-ui-container Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-preflight Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-preflight
    affected: workaround, no fix available “No current mitigation is available for this vulnerability.”
  • Red Hat Enterprise Linux 8 delve, grafana, go-toolset, grafana-pcp, grafana-loki, grafana-mssql, +15 more Red Hat Enterprise Linux 9 grafana, ignition, grafana-pcp, ignition-edge, ignition-grub, grafana-selinux, +5 more
    affected: workaround, no fix available, no fix planned “No current mitigation is available for this vulnerability.”
  • Red Hat OpenShift Data Science (RHODS) rhods/odh-mm-rest-proxy-rhel8 Red Hat OpenShift on AWS rosa
    affected: workaround, no fix planned “No current mitigation is available for this vulnerability.”
show 19 more
  • Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator
    affected: workaround, no fix available “No current mitigation is available for this vulnerability.”
  • Red Hat OpenStack Platform 16.2 etcd, rhosp-rhel8/osp-director-agent, golang-github-infrawatch-apputils
    affected: workaround, no fix available, no fix planned “No current mitigation is available for this vulnerability.”
  • Red Hat OpenStack Platform 17.1 golang-github-infrawatch-apputils
    affected: workaround, no fix available “No current mitigation is available for this vulnerability.”
  • Red Hat OpenStack Platform 18.0 etcd, rhoso-operators/ovn-rhel9-operator
    affected: workaround, no fix available, no fix planned “No current mitigation is available for this vulnerability.”
  • Red Hat Quay 3 quay/clair-rhel8
    affected: workaround, no fix available “No current mitigation is available for this vulnerability.”
  • Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests
    affected: workaround, no fix planned “No current mitigation is available for this vulnerability.”
  • Red Hat Web Terminal web-terminal-exec-container
    under investigation
  • Red Hat MTA 7.0 for RHEL 9 mta/mta-cli-rhel9 7.0.3-16
    fixed: vendor fix “No current mitigation is available for this vulnerability.” RHSA-2024:3316
  • Red Hat OpenShift API for Data Protection 1.3 oadp/oadp-velero-rhel9 1.3.1-16
    fixed: vendor fix “No current mitigation is available for this vulnerability.” RHSA-2024:1859
  • Red Hat OSSO 1.2 for RHEL 9 openshift-secondary-scheduler-operator/secondary-scheduler-rhel9-operator v1.2-26, openshift-secondary-scheduler-operator/secondary-scheduler-operator-bundle v1.2-19
    fixed: vendor fix “No current mitigation is available for this vulnerability.” RHSA-2024:0281
  • Red Hat Ceph Storage 7.1 Tools rhceph/rhceph-7-rhel9 7-493, rhceph/ceph-nvmeof-cli-rhel9 1.2.19-1, rhceph/grafana-rhel9 10.4.8-1740412443, rhceph/rhceph-promtail-rhel9 v3.0.0-14, rhceph/keepalived-rhel9 2.2.8-1740412056, rhceph/snmp-notifier-rhel9 1.2.1-1740411201, +1 more
    fixed: vendor fix “No current mitigation is available for this vulnerability.” RHBA-2025:1772
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.15-3.module+el8.9.0+21242+944321bb, crit 3.18-4.module+el8.9.0+20326+387084d0, criu 3.15-3.module+el8.9.0+21242+944321bb, criu 3.18-4.module+el8.9.0+20326+387084d0, crun 1.8.7-1.module+el8.9.0+21242+944321bb, runc 1.1.12-1.module+el8.9.0+21242+944321bb, +60 more
    fixed: vendor fix “No current mitigation is available for this vulnerability.” RHSA-2024:2988
  • Red Hat Enterprise Linux AppStream (v. 9) runc 1.1.12-2.el9, buildah 1.33.6-2.el9, podman 4.9.4-0.1.el9, skopeo 1.14.3-0.1.el9, buildah-tests 1.33.6-2.el9, podman-tests 4.9.4-0.1.el9, +5 more
    fixed: vendor fix “No current mitigation is available for this vulnerability.” RHSA-2024:2245
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) containernetworking-plugins 1.2.0-3.el9_2
    fixed: vendor fix “No current mitigation is available for this vulnerability.” RHSA-2024:4429
  • Red Hat OpenShift Container Platform 4.15 runc 1.1.12-1.rhaos4.15.el8, runc 1.1.12-1.rhaos4.15.el9, butane 0.20.0-1.rhaos4.15.el8, podman 4.4.1-21.rhaos4.15.el8, podman 4.4.1-21.rhaos4.15.el9, skopeo 1.11.2-21.1.rhaos4.15.el8, +34 more
    fixed: vendor fix “No current mitigation is available for this vulnerability.” RHSA-2023:7201
  • Red Hat OpenStack Platform 17.1 etcd 3.4.26-8.el9ost, collectd-sensubility 0.2.1-3.el8ost, collectd-sensubility 0.2.1-3.el9ost
    fixed: vendor fix “No current mitigation is available for this vulnerability.” RHSA-2024:2767
  • Red Hat Service Interconnect 1 service-interconnect/skupper-router-rhel9 2.5.1-2, service-interconnect/skupper-operator-bundle 1.5.3-3, service-interconnect/skupper-config-sync-rhel9 1.5.3-1, service-interconnect/skupper-flow-collector-rhel9 1.5.3-2, service-interconnect/skupper-site-controller-rhel9 1.5.3-2, service-interconnect/skupper-controller-podman-rhel9 1.5.3-1, +1 more
    fixed: vendor fix “No current mitigation is available for this vulnerability.” RHSA-2024:1901
  • Red Hat RODOO 1.1 for RHEL 9 run-once-duration-override-operator/run-once-duration-override-rhel9 v1.1-4, run-once-duration-override-operator/run-once-duration-override-rhel9-operator v1.1-5, run-once-duration-override-operator/run-once-duration-override-operator-bundle v1.1-4
    fixed: vendor fix “No current mitigation is available for this vulnerability.” RHSA-2024:0269
  • Red Hat Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8 5.2.1-6
    fixed: vendor fix “No current mitigation is available for this vulnerability.” RHSA-2024:1078

27 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.25% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.20.0
1.20.0
go stdlib
<1.20.0
1.20.0

Affected products

  • Go standard library crypto/tls

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.