vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2022-30629

Session tickets lack random ticket_age_add in crypto/tls

LOW
3.1
CVSS Score
Published: August 9, 2022 at 08:17 PM UTC
Updated: June 17, 2026 at 04:43 AM UTC
2 products affected across 2 vendorsGoGo

Using crypto/tls by Go standard library?

Get instant alerts when new vulnerabilities affect crypto/tls - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
LOW3.1
Exploit prediction
EPSS 1%
SSVC
No known exploit

Description

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Go· Golang
95%
v < 1.17.111.18.0 ≤ v < 1.18.3
Affected range stops below 1.17.11, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.18.3, so it looks safe — our inference, not a vendor statement
Go· Go Standard Librarygo
60%
v < 1.17.111.18.0-0 ≤ v < 1.18.31.18.0-0
Affected range stops below 1.17.11, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.18.3, so it looks safe — our inference, not a vendor statement

References (5)

Patch
Source: [email protected]
https://go.dev/cl/405994
ExploitIssue TrackingVendor Advisory
Source: [email protected]
https://go.dev/issue/52814
Mailing ListPatch
Source: [email protected]
https://go.googlesource.com/go/+/fe4de36198794c447fbd9d7cc2d7199a506c76a5
Mailing ListVendor Advisory
Source: [email protected]
https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ
Vendor Advisory
Source: [email protected]
https://pkg.go.dev/vuln/GO-2022-0531

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

3.1LOWCISA-ADP
Attack Vector
NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-330

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card