id: GO-2022-0531
modules:
    - module: std
      versions:
        - fixed: 1.17.11
        - introduced: 1.18.0-0
          fixed: 1.18.3
      vulnerable_at: 1.18.2
      packages:
        - package: crypto/tls
          symbols:
            - serverHandshakeStateTLS13.sendSessionTickets
summary: Session tickets lack random ticket_age_add in crypto/tls
description: |-
    An attacker can correlate a resumed TLS session with a previous connection.

    Session tickets generated by crypto/tls do not contain a randomly generated
    ticket_age_add, which allows an attacker that can observe TLS handshakes to
    correlate successive connections by comparing ticket ages during session
    resumption.
published: 2022-07-28T17:24:57Z
credits:
    - Github user @nervuri
references:
    - fix: https://go.dev/cl/405994
    - fix: https://go.googlesource.com/go/+/fe4de36198794c447fbd9d7cc2d7199a506c76a5
    - report: https://go.dev/issue/52814
    - web: https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ
cve_metadata:
    id: CVE-2022-30629
    cwe: 'CWE-200: Information Exposure'
    description: |-
        Non-random values for ticket_age_add in session tickets in crypto/tls before Go
        1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to
        correlate successive connections by comparing ticket ages during session
        resumption.