VDB
Sign up
LOW

GHSA-rrxv-pmq9-x67r

uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120

Quick fix

GHSA-rrxv-pmq9-x67r — github.com/refraction-networking/utls: upgrade to the fixed version with the command below.

go get github.com/refraction-networking/utls@v1.8.2

Details

The padding extension was incorrectly removed in utls for the non-pq variant of Chrome 120 fingerprint. Chrome removed this extension only when sending pq keyshares. Only this fingerprint is affected since newer fingerprints have pq keyshares by default and older fingerprints have this extension.

Affected symbols: `HelloChrome_120`

Fix commit: 8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0

Thanks to telegram @acgdaily for reporting this issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/refraction-networking/utls
Introduced in: 1.6.0Fixed in: 1.8.2
Fixgo get github.com/refraction-networking/utls@v1.8.2

References