Security readout for executives and security teams
Plain-English summary
This is a privacy weakness in Go's TLS implementation. In affected Go versions, session resumption tickets did not include enough randomness, allowing someone who can watch TLS handshakes to link repeat connections from the same client. It does not enable code execution, data modification, or service disruption.
Executive priority
Treat as a routine privacy fix. It should be included in normal Go patching and rebuild cycles, with priority for exposed services where connection correlation would matter.
Technical view
Go crypto/tls before Go 1.17.11 and Go 1.18.3 used non-random ticket_age_add values in session tickets. An observer of TLS handshakes could compare ticket ages during session resumption and correlate successive connections. The CVSS score is 3.1, with low confidentiality impact only.
Likely exposure
Exposure is likely limited to services or clients built with affected Go standard library versions that use crypto/tls session tickets. Statically built Go binaries may remain vulnerable until rebuilt with a fixed Go toolchain.
Exploitation context
The provided sources do not show active exploitation, and this CVE is not listed as KEV. Practical exploitation requires observing relevant TLS handshakes and correlating resumed sessions; the impact is connection tracking, not compromise of TLS contents.
Researcher notes
Focus validation on build provenance, not just source dependencies. The issue is in the Go standard library, so static binaries compiled before the fixed releases can remain affected even if source code has not changed.
Mitigation direction
- Upgrade Go to 1.17.11, 1.18.3, or a later fixed release.
- Rebuild and redeploy Go binaries built with affected toolchains.
- Prioritize internet-facing Go TLS services handling sensitive user activity.
- Check vendor guidance for appliances or products embedding Go crypto/tls.
Validation and detection
- Inventory Go versions used to build deployed binaries.
- Confirm vulnerable services were rebuilt after the Go toolchain upgrade.
- Review SBOMs or build metadata for affected Go runtime versions.
- Run dependency or vulnerability scanning for GO-2022-0531 or CVE-2022-30629.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-30629 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N1.61.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.1LowVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://go.dev/cl/405994CVE reference
- https://go.googlesource.com/go/+/fe4de36198794c447fbd9d7cc2d7199a506c76a5CVE reference
- https://go.dev/issue/52814CVE reference
- https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJCVE reference
- https://pkg.go.dev/vuln/GO-2022-0531CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.