Описание
Уязвимость компонента crypto/tls языка программирования Go связана с раскрытием информации при передаче данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации
Вендор
Red Hat, Inc.
ООО «Ред Софт»
Сообщество свободного программного обеспечения
The Go Project
Наименование ПО
Red Hat Enterprise Linux
Red Hat Quay
Red Hat 3scale API Management Platform
РЕД ОС
Red Hat Openshift Data Foundation
Red Hat OpenShift GitOps
Red Hat OpenShift Container Platform
Red Hat Satellite
Red Hat OpenStack Platform
Red Hat Web Terminal
OpenShift Developer Tools and Services
Red Hat Ceph Storage
Red Hat OpenShift on AWS
Node HealthCheck Operator
Network Observability Operator
Red Hat OpenShift Virtualization
OpenShift Serverless
Red Hat Ansible Automation Platform
Red Hat OpenShift Dev Spaces
Migration Toolkit for Containers
OpenShift Pipelines
OpenShift API for Data Protection
Red Hat Advanced Cluster Security
Logging subsystem for Red Hat OpenShift
Red Hat Developer Hub
multicluster engine for Kubernetes
OpenShift AI
Red Hat OpenShift Lightspeed
Red Hat OpenShift Cluster Manager CLI
Red Hat Trusted Artifact Signer
Red Hat Advanced Cluster Management for Kubernetes 2
Cryostat
Openshift Service Mesh
Builds for Red Hat OpenShift
cert-manager Operator for Red Hat OpenShift
Confidential Compute Attestation
Custom Metric Autoscaler operator for Red Hat Openshift
Multiarch Tuning Operator
Multicluster Global Hub
Debian GNU/Linux
Assisted Installer for Red Hat OpenShift Container Platform
Streams for Apache Kafka
Mirror registry for Red Hat OpenShift
Red Hat Connectivity Link
Red Hat Enterprise Linux AI
Service Telemetry Framework
External Secrets Operator for Red Hat OpenShift
Fence Agents Remediation Operator
Red Hat OpenShift distributed tracing
Red Hat Hardened Images
Compliance Operator
Deployment Validation Operator
File Integrity Operator
Machine Deletion Remediation Operator
Migration Toolkit for Applications
OpenShift Source-to-Image
Red Hat Edge Manager
Red Hat OpenShift Dev Workspaces Operator
Red Hat Service Interconnect
Security Profiles Operator
Zero Trust Workload Identity Manager
Gatekeeper
Logical Volume Manager Storage
Power monitoring for Red Hat OpenShift
Red Hat Lightspeed for Runtimes Operator
Red Hat OpenShift for Windows Containers
Go
Версия ПО
7 (Red Hat Enterprise Linux)
8 (Red Hat Enterprise Linux)
3 (Red Hat Quay)
2 (Red Hat 3scale API Management Platform)
7.3 (РЕД ОС)
4 (Red Hat Openshift Data Foundation)
- (Red Hat OpenShift GitOps)
4 (Red Hat OpenShift Container Platform)
6 (Red Hat Satellite)
9 (Red Hat Enterprise Linux)
16.2 (Red Hat OpenStack Platform)
- (Red Hat Web Terminal)
- (OpenShift Developer Tools and Services)
5 (Red Hat Ceph Storage)
- (Red Hat OpenShift on AWS)
- (Node HealthCheck Operator)
- (Network Observability Operator)
4 (Red Hat OpenShift Virtualization)
- (OpenShift Serverless)
2 (Red Hat Ansible Automation Platform)
17.1 (Red Hat OpenStack Platform)
- (Red Hat OpenShift Dev Spaces)
- (Migration Toolkit for Containers)
- (OpenShift Pipelines)
- (OpenShift API for Data Protection)
4 (Red Hat Advanced Cluster Security)
6 (Red Hat Ceph Storage)
- (Logging subsystem for Red Hat OpenShift)
- (Red Hat Developer Hub)
- (multicluster engine for Kubernetes)
7 (Red Hat Ceph Storage)
18.0 (Red Hat OpenStack Platform)
- (OpenShift AI)
8 (Red Hat Ceph Storage)
- (Red Hat OpenShift Lightspeed)
- (Red Hat OpenShift Cluster Manager CLI)
- (Red Hat Trusted Artifact Signer)
- (Red Hat Advanced Cluster Management for Kubernetes 2)
10 (Red Hat Enterprise Linux)
4 (Cryostat)
3 (Openshift Service Mesh)
- (Builds for Red Hat OpenShift)
- (cert-manager Operator for Red Hat OpenShift)
- (Confidential Compute Attestation)
- (Custom Metric Autoscaler operator for Red Hat Openshift)
- (Multiarch Tuning Operator)
- (Multicluster Global Hub)
13 (Debian GNU/Linux)
2 (Assisted Installer for Red Hat OpenShift Container Platform)
2 (Streams for Apache Kafka)
3 (Streams for Apache Kafka)
8.0 (РЕД ОС)
9 (Red Hat Ceph Storage)
2 (Mirror registry for Red Hat OpenShift)
1 (Red Hat Connectivity Link)
3 (Red Hat Enterprise Linux AI)
1.5 (Service Telemetry Framework)
- (External Secrets Operator for Red Hat OpenShift)
- (Fence Agents Remediation Operator)
3 (Red Hat OpenShift distributed tracing)
- (Red Hat Hardened Images)
- (Compliance Operator)
- (Deployment Validation Operator)
- (File Integrity Operator)
- (Machine Deletion Remediation Operator)
8 (Migration Toolkit for Applications)
- (OpenShift Source-to-Image)
1 (Red Hat Edge Manager)
- (Red Hat OpenShift Dev Workspaces Operator)
2 (Red Hat Service Interconnect)
- (Security Profiles Operator)
- (Zero Trust Workload Identity Manager)
3 (Gatekeeper)
- (Logical Volume Manager Storage)
- (Power monitoring for Red Hat OpenShift)
- (Red Hat Lightspeed for Runtimes Operator)
- (Red Hat OpenShift for Windows Containers)
3.10.2 (Red Hat OpenShift distributed tracing)
от 1.23.0 до 1.25.12 (Go)
от 1.26.0 до 1.26.5 (Go)
1.27 rc1 (Go)
Тип ПО
Операционная система
Прикладное ПО информационных систем
ПО программно-аппаратного средства
ПО виртуализации/ПО виртуального программно-аппаратного средства
Сетевое программное средство
Сетевое средство
ПО для разработки ИИ
Операционные системы и аппаратные платформы
Red Hat, Inc. Red Hat Enterprise Linux 7
Red Hat, Inc. Red Hat Enterprise Linux 8
ООО «Ред Софт» РЕД ОС 7.3
Red Hat, Inc. Red Hat Enterprise Linux 9
Red Hat, Inc. Red Hat Enterprise Linux 10
Сообщество свободного программного обеспечения Debian GNU/Linux 13
ООО «Ред Софт» РЕД ОС 8.0
Red Hat, Inc. Red Hat Enterprise Linux AI 3
Уровень опасности уязвимости
Средний уровень опасности (базовая оценка CVSS 2.0 составляет 5)
Средний уровень опасности (базовая оценка CVSS 3.1 составляет 5,3)
Возможные меры по устранению уязвимости
Использование рекомендаций:
Для Go:
https://go.dev/cl/775960
https://go.dev/issue/79282
https://groups.google.com/g/Go-announce/c/OrmQE_Yp5Sc
https://pkg.go.dev/vuln/GO-2026-5856
Для Debian GNU/Linux:
https://security-tracker.debian.org/tracker/CVE-2026-42505
https://deb.freexian.com/extended-lts/tracker/CVE-2026-42505
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/CVE-2026-42505
Для Ред ОС:
http://repo.red-soft.ru/redos/7.3c/x86_64/updates/
http://repo.red-soft.ru/redos/8.0/x86_64/updates/
Статус уязвимости
Подтверждена производителем
Наличие эксплойта
Данные уточняются
Информация об устранении
Уязвимость устранена
Ссылки на источники
Идентификаторы других систем описаний уязвимостей
- CVE
- GO
EPSS
Процентиль: 32%
0.00382
Низкий
5.3 Medium
CVSS3
5 Medium
CVSS2
Связанные уязвимости
CVSS3: 7.8
altlinux
3 месяца назад
ALT-PU-2026-13519: package `mimir` update to version 3.1.4-alt1
CVSS3: 7.8
altlinux
4 месяца назад
ALT-PU-2026-10640: package `golang` update to version 1.26.5-alt1
CVSS3: 5.3
ubuntu
4 месяца назад
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
CVSS3: 5.3
redhat
4 месяца назад
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
EPSS
Процентиль: 32%
0.00382
Низкий
5.3 Medium
CVSS3
5 Medium
CVSS2