Lucene search

K
osvGoogleOSV:GO-2024-2598
HistoryMar 05, 2024 - 10:14 p.m.

Verify panics on certificates with an unknown public key algorithm in crypto/x509

2024-03-0522:14:58
Google
osv.dev
9
crypto/x509
certificate chain
tls clients
tls servers
client authentication
software

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.4%

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic.

This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

CPENameOperatorVersion
stdliblt1.21.8
stdliblt1.22.1
stdlibge1.22.0-0