diff options
| author | Soumya Sambu <soumya.sambu@windriver.com> | 2023-08-25 07:41:38 +0000 |
|---|---|---|
| committer | Steve Sakoman <steve@sakoman.com> | 2023-08-30 04:46:35 -1000 |
| commit | f81d353d5bb44d47217ddc131e32a567534302d4 (patch) | |
| tree | 388e81b778c9b12576b4b032ac3e3835edabccb4 /scripts/lib/build_perf | |
| parent | e5f546b58b4a049d2ab701f912b40f3a9282d703 (diff) | |
| download | poky-f81d353d5bb44d47217ddc131e32a567534302d4.tar.gz | |
go: Fix CVE-2023-29409
Extremely large RSA keys in certificate chains can cause a
client/server to expend significant CPU time verifying
signatures. With fix, the size of RSA keys transmitted
during handshakes is restricted to <= 8192 bits. Based on
a survey of publicly trusted RSA keys, there are currently
only three certificates in circulation with keys larger than
this, and all three appear to be test certificates that are
not actively deployed. It is possible there are larger keys
in use in private PKIs, but we target the web PKI, so causing
breakage here in the interests of increasing the default
safety of users of crypto/tls seems reasonable.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-29409
(From OE-Core rev: 51c2fee0e4bb4b3131c61d91510394cd4b4f9eb9)
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'scripts/lib/build_perf')
0 files changed, 0 insertions, 0 deletions