| [ |
| { |
| "id": "GO-2022-0229", |
| "published": "2022-07-06T18:23:48Z", |
| "modified": "2022-09-20T15:16:04Z", |
| "aliases": [ |
| "CVE-2020-7919", |
| "GHSA-cjjc-xp8v-855w" |
| ], |
| "details": "On 32-bit architectures, a malformed input to crypto/x509 or\nthe ASN.1 parsing functions of golang.org/x/crypto/cryptobyte\ncan lead to a panic.\n\nThe malformed certificate can be delivered via a crypto/tls\nconnection to a client, or to a server that accepts client\ncertificates. net/http clients can be made to crash by an HTTPS\nserver, while net/http servers that accept client certificates\nwill recover the panic and are unaffected.\n", |
| "affected": [ |
| { |
| "package": { |
| "name": "stdlib", |
| "ecosystem": "Go" |
| }, |
| "ranges": [ |
| { |
| "type": "SEMVER", |
| "events": [ |
| { |
| "introduced": "0" |
| }, |
| { |
| "fixed": "1.12.16" |
| }, |
| { |
| "introduced": "1.13.0" |
| }, |
| { |
| "fixed": "1.13.7" |
| } |
| ] |
| } |
| ], |
| "database_specific": { |
| "url": "https://pkg.go.dev/vuln/GO-2022-0229" |
| }, |
| "ecosystem_specific": { |
| "imports": [ |
| { |
| "path": "crypto/x509" |
| } |
| ] |
| } |
| }, |
| { |
| "package": { |
| "name": "golang.org/x/crypto", |
| "ecosystem": "Go" |
| }, |
| "ranges": [ |
| { |
| "type": "SEMVER", |
| "events": [ |
| { |
| "introduced": "0" |
| }, |
| { |
| "fixed": "0.0.0-20200124225646-8b5121be2f68" |
| } |
| ] |
| } |
| ], |
| "database_specific": { |
| "url": "https://pkg.go.dev/vuln/GO-2022-0229" |
| }, |
| "ecosystem_specific": { |
| "imports": [ |
| { |
| "path": "golang.org/x/crypto/cryptobyte" |
| } |
| ] |
| } |
| } |
| ], |
| "references": [ |
| { |
| "type": "FIX", |
| "url": "https://go.dev/cl/216680" |
| }, |
| { |
| "type": "FIX", |
| "url": "https://go.googlesource.com/go/+/b13ce14c4a6aa59b7b041ad2b6eed2d23e15b574" |
| }, |
| { |
| "type": "FIX", |
| "url": "https://go.dev/cl/216677" |
| }, |
| { |
| "type": "REPORT", |
| "url": "https://go.dev/issue/36837" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://groups.google.com/g/golang-announce/c/Hsw4mHYc470" |
| } |
| ] |
| } |
| ] |
