Bug 849290 – <dev-lang/go-{1.17.11,1.18.3}: TLS ticket age non-random

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sam James 2022-06-02 06:19:08 UTC]

"""
We have just released Go versions 1.18.3 and 1.17.11, minor point releases.


* crypto/tls: session tickets lack random ticket_age_add

Session tickets generated by crypto/tls did not contain a randomly generated ticket_age_add. This allows an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

Thanks to GitHub user @nervuri for reporting this.

This is CVE-2022-30629 and Go issue https://go.dev/issue/52814.
"""

I've cut out the Windows-only vulnerabilities.

[Comment 1 Larry the Git Cow 2022-06-09 16:59:08 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dee98f65a274b281bee00b8ef7206ced6f76b436

commit dee98f65a274b281bee00b8ef7206ced6f76b436
Author:     William Hubbs <[e-mail]>
AuthorDate: 2022-06-09 15:57:31 +0000
Commit:     William Hubbs <[e-mail]>
CommitDate: 2022-06-09 16:58:26 +0000

    dev-lang/go: add 1.17.11, 1.18.3
    
    Bug: https://bugs.gentoo.org/849290
    Signed-off-by: William Hubbs <[e-mail]>

 dev-lang/go/Manifest          |   2 +
 dev-lang/go/go-1.17.11.ebuild | 196 ++++++++++++++++++++++++++++++++++++++++++
 dev-lang/go/go-1.18.3.ebuild  | 196 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 394 insertions(+)

[Comment 2 John Helmert III 2022-06-09 18:46:57 UTC]

Thanks! Please stabilize when ready.

[Comment 3 John Helmert III 2022-06-12 12:50:57 UTC]

Please cleanup

[Comment 4 Larry the Git Cow 2022-06-15 16:08:44 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=92dba5af79a9fe9db351bd8c61178a23b48e7a17

commit 92dba5af79a9fe9db351bd8c61178a23b48e7a17
Author:     William Hubbs <[e-mail]>
AuthorDate: 2022-06-15 16:06:27 +0000
Commit:     William Hubbs <[e-mail]>
CommitDate: 2022-06-15 16:06:56 +0000

    dev-lang/go: drop 1.17.10, 1.18.2
    
    Bug: https://bugs.gentoo.org/849290
    Signed-off-by: William Hubbs <[e-mail]>

 dev-lang/go/Manifest          |   2 -
 dev-lang/go/go-1.17.10.ebuild | 196 ------------------------------------------
 dev-lang/go/go-1.18.2.ebuild  | 196 ------------------------------------------
 3 files changed, 394 deletions(-)

[Comment 5 John Helmert III 2022-06-15 16:17:54 UTC]

Thanks!

[Comment 6 Larry the Git Cow 2022-08-04 14:02:33 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=3cb3a96a3023359a20f60ec1f45f10c1fc4012ca

commit 3cb3a96a3023359a20f60ec1f45f10c1fc4012ca
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-08-04 13:53:02 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-08-04 13:59:34 +0000

    [ GLSA 202208-02 ] Go: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/754210
    Bug: https://bugs.gentoo.org/766216
    Bug: https://bugs.gentoo.org/775326
    Bug: https://bugs.gentoo.org/788640
    Bug: https://bugs.gentoo.org/794784
    Bug: https://bugs.gentoo.org/802054
    Bug: https://bugs.gentoo.org/806659
    Bug: https://bugs.gentoo.org/807049
    Bug: https://bugs.gentoo.org/816912
    Bug: https://bugs.gentoo.org/821859
    Bug: https://bugs.gentoo.org/828655
    Bug: https://bugs.gentoo.org/833156
    Bug: https://bugs.gentoo.org/834635
    Bug: https://bugs.gentoo.org/838130
    Bug: https://bugs.gentoo.org/843644
    Bug: https://bugs.gentoo.org/849290
    Bug: https://bugs.gentoo.org/857822
    Bug: https://bugs.gentoo.org/862822
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202208-02.xml | 101 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 101 insertions(+)

[Comment 7 John Helmert III 2022-08-04 14:08:33 UTC]

GLSA released, all done!