[GO-2024-2598] Verify panics on certificates with an unknown public key algorithm in crypto/x509
Affected Packages
2
Fixed Packages
2
CVEs
1
Verifying a certificate chain which contains a certificate with an unknown
public key algorithm will cause Certificate.Verify to panic.
This affects all crypto/tls clients, and servers that set Config.ClientAuth to
VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is
for TLS servers to not verify client certificates.
Package | Affected Version |
---|---|
pkg:golang/crypto/x509 | >= 1.22.0, < 1.21.8 |
pkg:golang/crypto/x509 | >= 1.22.0, < 1.22.1 |
Package | Fixed Version |
---|---|
pkg:golang/crypto/x509 | = 1.21.8 |
pkg:golang/crypto/x509 | = 1.22.1 |
- ID
- GO-2024-2598
- URL
- https://pkg.go.dev/vuln/GO-2024-2598
- Published
-
2024-03-05T21:33:39
(6 months ago) - Modified
-
2024-07-17T19:54:18
(2 months ago) - Other Advisories
-
- ALAS2-2024-2554
- ALPINE:CVE-2024-24783
- ALSA-2024:2562
- ALSA-2024:2724
- ALSA-2024:3259
- ALSA-2024:3346
- ALSA-2024:5258
- ALSA-2024:6186
- ALSA-2024:6187
- ALSA-2024:6188
- ALSA-2024:6189
- ALSA-2024:6194
- ALSA-2024:6195
- ELSA-2024-2562
- ELSA-2024-2724
- ELSA-2024-3259
- ELSA-2024-3346
- ELSA-2024-5258
- ELSA-2024-6186
- ELSA-2024-6187
- ELSA-2024-6188
- ELSA-2024-6189
- ELSA-2024-6194
- ELSA-2024-6195
- FREEBSD:B1B039EC-DBFC-11EE-9165-901B0E9408DC
- GLSA-202408-07
- RHSA-2024:2562
- RHSA-2024:2724
- RHSA-2024:3259
- RHSA-2024:3346
- RHSA-2024:5258
- RHSA-2024:6186
- RHSA-2024:6187
- RHSA-2024:6188
- RHSA-2024:6189
- RHSA-2024:6194
- RHSA-2024:6195
- RLSA-2024:2562
- RLSA-2024:2724
- RLSA-2024:3346
- SUSE-SU-2024:0800-1
- SUSE-SU-2024:0811-1
- SUSE-SU-2024:0812-1
- SUSE-SU-2024:0936-1
- SUSE-SU-2024:3089-1
- USN-6886-1
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Fixed | pkg:golang/crypto/x509 | crypto | x509 | = 1.21.8 | |||
Affected | pkg:golang/crypto/x509 | crypto | x509 | >= 1.22.0 < 1.21.8 | |||
Fixed | pkg:golang/crypto/x509 | crypto | x509 | = 1.22.1 | |||
Affected | pkg:golang/crypto/x509 | crypto | x509 | >= 1.22.0 < 1.22.1 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |