GO-2024-2598
Verify panics on certificates with an unknown public key algorithm in crypto/x509
At a glance
- Published
- Updated
- CVE
- CVE-2024-24783
- Aliases
- BIT-golang-2024-24783
Description
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.
Affected packages
| Package | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.21.8, introduced 1.22.0-0, fixed 1.22.1 |
References
- https://go.dev/issue/65390 REPORT
- https://go.dev/cl/569339 FIX
- https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |