GO-2022-0434

vendorUSosv

Panic during certificate parsing on Darwin in crypto/x509

view advisory published 2022-05-23Licence: per source

Verifying certificate chains containing certificates which are not compliant with RFC 5280 causes Certificate.Verify to panic on macOS. These chains can be delivered through TLS and can cause a crypto/tls or net/http client to crash.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-27536US	high7.5	1.47% (74th)	—	2022-04-20
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/393655FIX
https://go.dev/issue/51759REPORT
https://go.googlesource.com/go/+/0fca8a8f25cf4636fd980e72ba0bded4230922deFIX
https://groups.google.com/g/golang-announce/c/oecdBNLOml8WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan