GO-2022-0434
Panic during certificate parsing on Darwin in crypto/x509
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2022-27536
- Alias
- BIT-golang-2022-27536
Description
Verifying certificate chains containing certificates which are not compliant with RFC 5280 causes Certificate.Verify to panic on macOS. These chains can be delivered through TLS and can cause a crypto/tls or net/http client to crash.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · stdlib | introduced 1.18.0-0, fixed 1.18.1 |
Références
- https://go.dev/cl/393655 FIX
- https://go.googlesource.com/go/+/0fca8a8f25cf4636fd980e72ba0bded4230922de FIX
- https://go.dev/issue/51759 REPORT
- https://groups.google.com/g/golang-announce/c/oecdBNLOml8 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |