CVE-2023-45287

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels.

• CWE-203

• https://go.dev/cl/326012/26Issue Tracking
• https://go.dev/issue/20654Issue Tracking
• https://groups.google.com/g/golang-announce/c/QMK8IQALDvAMailing List, Release Notes
• https://people.redhat.com/~hkario/marvin/Third Party Advisory
• https://pkg.go.dev/vuln/GO-2023-2375Vendor Advisory
• https://security.netapp.com/advisory/ntap-20240112-0005/
• https://go.dev/cl/326012/26Issue Tracking
• https://go.dev/issue/20654Issue Tracking
• https://groups.google.com/g/golang-announce/c/QMK8IQALDvAMailing List, Release Notes
• https://people.redhat.com/~hkario/marvin/Third Party Advisory
• https://pkg.go.dev/vuln/GO-2023-2375Vendor Advisory
• https://security.netapp.com/advisory/ntap-20240112-0005/

Published

Dec 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45281An issue in Yamcs 5.8.6 allows attackers to obtain the sessi…6.1
• CVE-2023-45282In NASA Open MCT (aka openmct) before 3.1.0, prototype pollu…7.5
• CVE-2023-45283The filepath package does not recognize paths with a \??\ pr…7.5
• CVE-2023-45284On Windows, The IsLocal function does not correctly detect r…5.3
• CVE-2023-45285Using go get to fetch a module with the ".git" suffix may un…7.5
• CVE-2023-45286A race condition in go-resty can result in HTTP request body…5.9
• CVE-2023-45288An attacker may cause an HTTP/2 endpoint to read arbitrary a…7.5
• CVE-2023-45289When following an HTTP redirect to a domain which is not a s…4.3
• CVE-2023-45290When parsing a multipart form (either explicitly with Reques…6.5
• CVE-2023-45291Rejected reason: reserved but not needed
• CVE-2023-45292When using the default implementation of Verify to check a C…5.3
• CVE-2023-4530Improper Neutralization of Special Elements used in an SQL C…9.8