| Package | Affected versions | Patched versions |
|---|---|---|
| stdlib | ≥ 1.18.0-0, < 1.18.3< 1.17.11 | 1.18.31.17.11 |
| go | ≥ 1.18.0, < 1.18.3< 1.17.11 | 1.18.31.17.11 |
An attacker can correlate a resumed TLS session with a previous connection.
Session tickets generated by crypto/tls do not contain a randomly generated ticket_age_add, which allows an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free