GO-2022-0213

Source
https://pkg.go.dev/vuln/GO-2022-0213
Import Source
https://vuln.go.dev/ID/GO-2022-0213.json
Aliases
Published
2022-05-24T20:14:11Z
Modified
2023-11-08T04:01:24.983775Z
Summary
Panic on invalid DSA public keys in crypto/dsa
Details

Invalid DSA public keys can cause a panic in dsa.Verify. In particular, using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don't chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server that accepts and verifies client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected.

Moreover, an application might crash invoking crypto/x509.(*CertificateRequest).CheckSignature on an X.509 certificate request, parsing a golang.org/x/crypto/openpgp Entity, or during a golang.org/x/crypto/otr conversation. Finally, a golang.org/x/crypto/ssh client can panic due to a malformed host key, while a server could panic if either PublicKeyCallback accepts a malformed public key, or if IsUserAuthority accepts a certificate with a malformed public key.

References

Affected packages

Go / stdlib

Package

Name
stdlib

Affected ranges

Type
SEMVER
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.12.11
Introduced
1.13.0-0
Fixed
1.13.2

Ecosystem specific 

{
    "imports": [
        {
            "path": "crypto/dsa",
            "symbols": [
                "Verify"
            ]
        }
    ]
}