Description
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Go standard library | crypto/tls | < 1.20.0 | 1.20.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | golang-1.19 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | golang-1.20 | No fix yet | — |
| Ubuntu 20.04 LTS | golang-1.20 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | buildah +1 | 2:1.33.6-2.el9 | RHSA-2024:2245 |
| RHEL 9 | containernetworking-plugins | 1:1.4.0-2.el9_4 | RHSA-2024:2272 |
| RHEL 9 | podman +4 | 2:4.9.4-0.1.el9 | RHSA-2024:2193 |
| RHEL 9 | runc | 4:1.1.12-2.el9 | RHSA-2024:2180 |
| RHEL 9 | skopeo +1 | 2:1.14.3-0.1.el9 | RHSA-2024:2239 |
| RHEL 8 | buildah +1 | 1:1.24.6-7.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | cockpit-podman | 46-1.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | conmon | 2:2.1.4-2.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | container-selinux | 2:2.205.0-3.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | containernetworking-plugins | 1:1.1.1-6.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | containers-common | 2:1-38.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | crit +4 | 3.15-3.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | crun | 1.8.7-1.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | fuse-overlayfs | 1.9-2.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | libslirp +1 | 4.4.0-1.module+el8.9.0+20326+387084d0 | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | netavark +1 | 2:1.0.1-38.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | oci-seccomp-bpf-hook | 1.2.5-2.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | podman +6 | 2:4.0.2-26.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | python-podman +1 | 4.0.0-2.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | runc | 1:1.1.12-1.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | skopeo +1 | 2:1.6.2-9.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | slirp4netns | 1.1.8-3.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | toolbox +1 | 0.0.99.4-5.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | udica | 0.2.6-4.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | containernetworking-plugins | 1:1.2.0-3.el9_2 | RHSA-2024:4429 |
| Red Hat OpenStack 17 | collectd-sensubility | 0.2.1-3.el8ost | RHSA-2024:2767, RHSA-2024:2730 |
| Red Hat OpenStack 17 | etcd | 3.4.26-8.el9ost | RHSA-2024:2729 |
| Red Hat OpenShift 4 | buildah +1 | 1:1.29.1-20.2.rhaos4.15.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | butane +1 | 0.20.0-1.rhaos4.15.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | containernetworking-plugins | 1:1.4.0-1.1.rhaos4.15.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | cri-o | 1.28.3-14.rhaos4.15.git33aabd8.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | cri-tools | 1.28.0-3.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | ignition +1 | 2.16.2-2.rhaos4.15.el9 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | microshift +5 | 4.15.0-202402260721.p0.g799289b.assembly.4.15.0.el9 | RHSA-2023:7200 |
| Red Hat OpenShift 4 | openshift +1 | 4.15.0-202402142009.p0.g6216ea1.assembly.stream.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.15.0-202402070507.p0.g48dcf59.assembly.stream.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | podman +6 | 3:4.4.1-21.rhaos4.15.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | runc | 4:1.1.12-1.rhaos4.15.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | skopeo +1 | 2:1.11.2-21.1.rhaos4.15.el8 | RHSA-2023:7201 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | buildah +1 | 2:1.33.6-2.el9 | ALSA-2024:2245 |
| AlmaLinux 9 | containernetworking-plugins | 1:1.4.0-2.el9_4 | ALSA-2024:2272 |
| AlmaLinux 9 | podman +4 | 2:4.9.4-0.1.el9 | ALSA-2024:2193 |
| AlmaLinux 9 | runc | 4:1.1.12-2.el9 | ALSA-2024:2180 |
| AlmaLinux 9 | skopeo +1 | 2:1.14.3-0.1.el9 | ALSA-2024:2239 |
| AlmaLinux 8 | buildah +1 | 1:1.24.6-7.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | cockpit-podman | 46-1.module_el8.7.0+3344+5bcd850f | ALSA-2024:0748 |
| AlmaLinux 8 | conmon | 2:2.1.4-2.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | container-selinux | 2:2.205.0-3.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | containernetworking-plugins | 1:1.1.1-6.module_el8.9.0+3711+04fcca5e | ALSA-2024:0748 |
| AlmaLinux 8 | containers-common | 2:1-38.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | crit +4 | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2024:0748 |
| AlmaLinux 8 | crun | 1.8.7-1.module_el8.9.0+3683+33eb0feb | ALSA-2024:0748 |
| AlmaLinux 8 | fuse-overlayfs | 1.9-2.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | libslirp +1 | 4.4.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2024:0748 |
| AlmaLinux 8 | netavark +1 | 2:1.0.1-38.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module_el8.8.0+3468+16b86c82 | ALSA-2024:0748 |
| AlmaLinux 8 | podman +6 | 2:4.0.2-26.module_el8.9.0+3722+7fd8ab2b.alma.1 | ALSA-2024:0748 |
| AlmaLinux 8 | python3-podman | 4.0.0-2.module_el8.9.0+3711+04fcca5e | ALSA-2024:0748 |
| AlmaLinux 8 | runc | 1:1.1.12-1.module_el8.9.0+3722+7fd8ab2b | ALSA-2024:0748 |
| AlmaLinux 8 | skopeo +1 | 2:1.6.2-9.module_el8.9.0+3687+dcd7ef8f.alma.1 | ALSA-2024:0748 |
| AlmaLinux 8 | slirp4netns | 1.1.8-3.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | toolbox +1 | 0.0.99.4-5.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | udica | 0.2.6-4.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | buildah | 1:1.24.6-7.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Rocky Linux 8 | cockpit-podman | 46-1.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | conmon | 2:2.1.4-2.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | container-selinux | 2:2.205.0-3.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | containers-common | 2:1-38.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | criu | 3.15-3.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Rocky Linux 8 | crun | 1.14.3-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | fuse-overlayfs | 1.9-2.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | libslirp | 4.4.0-1.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | netavark | 2:1.10.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | python-podman | 4.0.0-2.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | runc | 1:1.1.12-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | skopeo | 2:1.6.2-9.module+el8.9.0+1578+aa900b44 | RLSA-2024:0748 |
| Rocky Linux 8 | slirp4netns | 1.1.8-3.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | toolbox | 0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2 | RLSA-2024:2988 |
| Rocky Linux 8 | udica | 0.2.6-4.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | 1.20.0-1 | — |
| Azure Linux 2 (CBL-Mariner) | golang +1 | 1.20.0-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | buildah +1 | 2:1.33.6-2.0.1.el9 | ELSA-2024-2245 |
| Oracle Linux 9 | containernetworking-plugins | 1:1.4.0-2.el9_4 | ELSA-2024-2272 |
| Oracle Linux 9 | podman +4 | 2:4.9.4-0.1.0.1.el9 | ELSA-2024-2193 |
| Oracle Linux 9 | runc | 4:1.1.12-2.el9 | ELSA-2024-2180 |
| Oracle Linux 9 | skopeo +1 | 2:1.14.3-0.1.el9 | ELSA-2024-2239 |
| Oracle Linux 8 | buildah +1 | 1:1.24.6-7.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | cockpit-podman | 46-1.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | conmon | 2:2.1.4-2.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | container-selinux | 2:2.205.0-3.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | containernetworking-plugins | 1:1.1.1-6.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | containers-common | 2:1-38.0.1.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | crit +4 | 3.15-3.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | crun | 1.8.7-1.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | fuse-overlayfs | 1.9-2.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | libslirp +1 | 4.4.0-1.module+el8.9.0+90147+a4870853 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | netavark +1 | 2:1.0.1-38.0.1.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | podman +6 | 2:4.0.2-25.0.1.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | python3-podman | 4.0.0-2.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | runc | 1:1.1.12-1.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | skopeo +1 | 2:1.6.2-9.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | slirp4netns | 1.1.8-3.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
| Oracle Linux 8 | udica | 0.2.6-4.module+el8.9.0+90148+6046e3c3 | ELSA-2024-2988, ELSA-2024-0748 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | stdlib | < 1.20.0 | 1.20.0 | GO-2023-2375 |
Advisories 32
- ALSA-2024:2193 Moderate: podman security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2180 Moderate: runc security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2245 Moderate: buildah security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2239 Moderate: skopeo security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2272 Moderate: containernetworking-plugins security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:0748 Important: container-tools:4.0 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:2988 Red Hat Security Advisory: container-tools:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:2180 Red Hat Security Advisory: runc security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:7201 Red Hat Security Advisory: OpenShift Container Platform 4.15.0 packages and security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:7200 Red Hat Security Advisory: OpenShift Container Platform 4.15.z security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:2730 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (collectd-sensubility) security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:2767 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (collectd-sensubility) security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:2729 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (etcd) security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:2272 Red Hat Security Advisory: containernetworking-plugins security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:2193 Red Hat Security Advisory: podman security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:2245 Red Hat Security Advisory: buildah security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:0748 Red Hat Security Advisory: container-tools:4.0 security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:4429 Red Hat Security Advisory: containernetworking-plugins security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:2239 Red Hat Security Advisory: skopeo security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- WID-SEC-2024-1226 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
- WID-SEC-2024-1228 Red Hat OpenStack: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2026
- RLSA-2024:2988 Moderate: container-tools:rhel8 security update Rocky Linux Security Advisories · May 7, 2025
- RLSA-2024:0748 Important: container-tools:4.0 security update Rocky Linux Security Advisories · May 7, 2025
- WID-SEC-2024-0521 IBM MQ: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 15, 2024
- WID-SEC-2023-3059 Golang Go: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jul 31, 2024
- ELSA-2024-2988 Moderate: container-tools:ol8 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 24, 2024
- ELSA-2024-2193 Moderate: podman security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 3, 2024
- ELSA-2024-2245 Moderate: buildah security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 3, 2024
- ELSA-2024-2180 Moderate: runc security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 2, 2024
- ELSA-2024-2239 Moderate: skopeo security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 2, 2024
- ELSA-2024-2272 Moderate: containernetworking-plugins security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 2, 2024
- ELSA-2024-0748 Important: container-tools:4.0 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 14, 2024