CVE-2022-41724
CVE Details
Visit the official vulnerability details page for CVE-2022-41724 to learn more.
Initial Publication
11/13/2024
Last Update
12/12/2024
Third Party Dependency
go
NIST CVE Summary
Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).
CVE Severity
Our Official Summary
This vulnerability is a false positive. Although this is reported by the scanning tools on some of the components, further checks indicate the symbol/function with the vulnerability while present is not being used.
Status
Ongoing
Affected Products & Versions
| Version | Palette Enterprise | Palette Enterprise Airgap | VerteX | VerteX Airgap |
|---|---|---|---|---|
| 4.5.15 | ✅ No Impact | ✅ No Impact | ⚠️ Impacted | ⚠️ Impacted |
| 4.5.11 | ✅ No Impact | ✅ No Impact | ⚠️ Impacted | ⚠️ Impacted |
| 4.5.10 | ✅ No Impact | ✅ No Impact | ⚠️ Impacted | ⚠️ Impacted |
| 4.5.8 | ✅ No Impact | ✅ No Impact | ⚠️ Impacted | ⚠️ Impacted |
| 4.5.5 | ✅ No Impact | ✅ No Impact | ⚠️ Impacted | ⚠️ Impacted |
| 4.5.4 | ✅ No Impact | ✅ No Impact | ⚠️ Impacted | ⚠️ Impacted |
| 4.4.20 | ✅ No Impact | ⚠️ Impacted | ⚠️ Impacted | ⚠️ Impacted |
Revision History
| Date | Revision |
|---|---|
| 12/12/2024 | Official summary revised: This vulnerability is a false positive. Although this is reported by the scanning tools on some of the components, further checks indicate the symbol/function with the vulnerability while present is not being used. |