CVE-2018-16875 Denial of service in chain verification in crypto/x509
HighCVSS 7.5
EPSS 6.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| stdlib(Go) | < 1.10.6 | 1.10.6 |
| stdlib(Go) | >= 1.11.0-0, < 1.11.3 | 1.11.3 |
| golang go | < 1.10.6 | 1.10.6 |
| golang go | >= 1.11.0, < 1.11.3 | 1.11.3 |
| openSUSE leap | = 42.3 | No fix listed |
| [UNKNOWN] golang | = 1.10.6 | No fix listed |
| [UNKNOWN] golang | = 1.11.3 | No fix listed |
References
- go.dev patch
- go.googlesource.com patch
- go.dev issue-tracking
- groups.google.com
- openSUSE-SU-2019:1079 third-party-advisory vendor-advisory
- openSUSE-SU-2019:1444 vendor-advisory
- openSUSE-SU-2019:1499 vendor-advisory
- openSUSE-SU-2019:1506 vendor-advisory
- openSUSE-SU-2019:1703 vendor-advisory
- 106230 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory
- groups.google.com
- GLSA-201812-09 mitigation third-party-advisory vendor-advisory