Resource Exhaustion The advisory has been revoked - it doesn't affect any version of package golang-src Open this link in a new tab

The Red Hat security team deemed this advisory irrelevant for RHEL:7.

Note: Versions mentioned in the description apply only to the upstream golang-src package and not the golang-src package as distributed by RHEL.

Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).

• https://access.redhat.com/security/cve/CVE-2022-41724
• https://go.dev/cl/468125
• https://go.dev/issue/58001
• https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E
• https://pkg.go.dev/vuln/GO-2023-1570
• https://security.gentoo.org/glsa/202311-09