CVE-2023-45287

CVE-2023-45287 is a high-severity timing side-channel vulnerability affecting Go versions prior to 1.20, specifically within the crypto/tls library's RSA key exchange implementation. The flaw, rated 7.5 CVSS, could allow an unauthenticated attacker to remotely recover session key bits by exploiting timing information leaked during PKCS#1 padding removal. While RSA blinding was intended to mitigate such attacks, it was found to be insufficient. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.