GO-2022-0191

vendorUSosv

Denial of service in chain verification in crypto/x509

view advisory published 2022-07-15Licence: per source

The crypto/x509 package does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients verifying certificates are affected.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-16875US	high7.5	6.38% (94th)	—	2018-12-14
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft p…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/154105FIX
https://go.dev/issue/29233REPORT
https://go.googlesource.com/go/+/770130659b6fb2acf271476579a3644e093dda7fFIX
https://groups.google.com/g/golang-announce/c/Kw31K8G7Fi0WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan