VDB

CVE-2024-24792

CVE-2024-24792 PUBLISHED CVSS 5.300000190734863 MEDIUM

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

EPSS 0.74% · 51.1th percentile

Risk Scores

CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score
0.74%
51.1th percentile

Affected Products

VendorProductVersions
Go standard librarycrypto/tls0, 1.25.0

Timeline

  • Oct 5, 2023 PoC Published
  • Jun 25, 2024 CVE Published
  • Jun 28, 2024 EPSS Score
  • Jul 20, 2024 EPSS Score
  • Aug 12, 2024 EPSS Score
  • Sep 3, 2024 EPSS Score
  • Sep 26, 2024 EPSS Score
  • Oct 4, 2024 Coalition ESS Score
  • Oct 18, 2024 EPSS Score
  • Nov 10, 2024 EPSS Score
  • Dec 3, 2024 EPSS Score
  • Jan 17, 2025 EPSS Score

References

…and 34 more

Open in Interactive Console →
$ Console Community · 100/wk Open console ›