GO-2025-3373

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2025-3373

Import Source

https://vuln.go.dev/ID/GO-2025-3373.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2025-3373

Aliases

Published

2025-01-28T00:47:30Z

Modified

2025-01-30T20:12:14.327943Z

Summary

Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

Details

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain.

Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2025-3373"
}

References

Credits

- Juho Forsén of Mattermost

Affected packages

Go / stdlib

Package

Name: stdlib; View open source insights on deps.dev
Purl: pkg:golang/stdlib

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.22.11

Introduced

1.23.0-0

Fixed

1.23.5

Introduced

1.24.0-0

Fixed

1.24.0-rc.2

Ecosystem specific

{
    "imports": [
        {
            "path": "crypto/x509",
            "symbols": [
                "CertPool.AppendCertsFromPEM",
                "Certificate.CheckCRLSignature",
                "Certificate.CheckSignature",
                "Certificate.CheckSignatureFrom",
                "Certificate.CreateCRL",
                "Certificate.Verify",
                "Certificate.VerifyHostname",
                "CertificateRequest.CheckSignature",
                "CreateCertificate",
                "CreateCertificateRequest",
                "CreateRevocationList",
                "DecryptPEMBlock",
                "EncryptPEMBlock",
                "HostnameError.Error",
                "MarshalECPrivateKey",
                "MarshalPKCS1PrivateKey",
                "MarshalPKCS1PublicKey",
                "MarshalPKCS8PrivateKey",
                "MarshalPKIXPublicKey",
                "ParseCRL",
                "ParseCertificate",
                "ParseCertificateRequest",
                "ParseCertificates",
                "ParseDERCRL",
                "ParseECPrivateKey",
                "ParsePKCS1PrivateKey",
                "ParsePKCS1PublicKey",
                "ParsePKCS8PrivateKey",
                "ParsePKIXPublicKey",
                "ParseRevocationList",
                "RevocationList.CheckSignatureFrom",
                "SetFallbackRoots",
                "SystemCertPool",
                "matchURIConstraint"
            ]
        }
    ]
}