Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
cri-tools may accept resumed TLS sessions after CA changes
published 18 days ago
Summary
The cri-tools component can mistakenly allow a TLS connection to continue when the list of trusted certificate authorities is changed between the original and resumed handshakes. This could let an unauthorized party keep a connection that should have been rejected. Update cri-tools to a version that fixes the handling of certificate authority changes during session resumption.
What to do
- Update cleanstart cri-tools to version 1.29.0-r5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | cri-tools |
< 1.29.0-r5 Fix: upgrade to 1.29.0-r5
|
Original advisory text
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...
Security vulnerability affects the cri-tools package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published1 Oct 2026
Updated1 Oct 2026
First seen1 Oct 2026
Sources
CLEANSTART-2026-NB75490 · OSV
Track software like this
Free during beta