CVE-2023-29409

Summary

CVE-2023-29409 is a vulnerability affecting certificate chains with extremely large RSA keys. These oversized keys can result in significant CPU usage for clients and servers while verifying signatures. To mitigate this issue, a fix has been implemented restricting transmitted RSA keys during handshakes to 8192 bits or less. Although only three known certificates in circulation have keys larger than this limit, they are all believed to be test certificates and not actively deployed. The web PKI is the primary focus, and the safety improvement for users of crypto/tls justifies the potential breakage in private PKIs.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.