Description
crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go | 1.7.0-2.1 | openSUSE-SU-2024:10028-1 |
| openSUSE Tumbleweed | go1.10 | 1.10.8-8.2 | openSUSE-SU-2024:10803-1 |
| openSUSE Tumbleweed | go1.11 | 1.11.13-10.5 | openSUSE-SU-2024:10804-1 |
| openSUSE Tumbleweed | go1.12 | 1.12.17-4.8 | openSUSE-SU-2024:10805-1 |
| openSUSE Tumbleweed | go1.4 | 1.4.3-12.2 | openSUSE-SU-2024:10811-1 |
| openSUSE Tumbleweed | go1.9 | 1.9.7-11.2 | openSUSE-SU-2024:10812-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | stdlib | >= 1.1.0-0, < 1.3.2 | 1.3.2 | GO-2021-0154 |
Advisories 6
- openSUSE-SU-2024:10811-1 go1.4-1.4.3-12.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10803-1 go1.10-1.10.8-8.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10812-1 go1.9-1.9.7-11.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10804-1 go1.11-1.11.13-10.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10028-1 go-1.7.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10805-1 go1.12-1.12.17-4.8 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026