Vulnerability Report: GO-2022-0191
- CVE-2018-16875
- Affects: crypto/x509
- Published: Jul 15, 2022
- Modified: Jun 12, 2023
The crypto/x509 package does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients verifying certificates are affected.
Affected Packages
-
PathVersionsSymbols
-
before go1.10.6, from go1.11.0-0 before go1.11.3all symbols
Aliases
References
- https://go.dev/cl/154105
- https://go.googlesource.com/go/+/770130659b6fb2acf271476579a3644e093dda7f
- https://go.dev/issue/29233
- https://groups.google.com/g/golang-announce/c/Kw31K8G7Fi0
- https://vuln.go.dev/ID/GO-2022-0191.json
Credits
- Netflix
Feedback
See anything missing or incorrect?
Suggest an edit to this report.