GO-2021-0243
Panic on certain certificates in crypto/tls
At a glance
- Published
- Updated
- CVE
- CVE-2021-34558
- Aliases
- BIT-golang-2021-34558
Description
crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters. net/http clients performing HTTPS requests are also affected.
Affected packages
| Package | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.15.14, introduced 1.16.0-0, fixed 1.16.6 |
References
- https://go.dev/cl/334031 FIX
- https://go.googlesource.com/go/+/a98589711da5e9d935e8d690cfca92892e86d557 FIX
- https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ WEB
- https://go.dev/issue/47143 REPORT
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |