VDB

CVE-2024-24792

CVE-2024-24792 PUBLISHED CVSS 5.300000190734863 MEDIUM

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

EPSS 0.74% · 54.2th percentile

Risk Scores

CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score
0.74%
54.2th percentile

Affected Products

VendorProductVersions
Go standard librarycrypto/tls0, 1.25.0

Timeline

  • Oct 5, 2023 PoC Published
  • Jun 25, 2024 CVE Published
  • Jun 28, 2024 EPSS Score
  • Jul 21, 2024 EPSS Score
  • Aug 14, 2024 EPSS Score
  • Sep 6, 2024 EPSS Score
  • Sep 30, 2024 EPSS Score
  • Oct 4, 2024 Coalition ESS Score
  • Nov 15, 2024 EPSS Score
  • Dec 10, 2024 EPSS Score
  • Jan 2, 2025 EPSS Score
  • Jan 25, 2025 EPSS Score

References

…and 34 more

Open in Interactive Console →
$ Console Community · 50/day Open console ›