x/vulndb: add GO-2022-0213 for CVE-2019-17596
Fixes #213
Change-Id: I5cf3d983bf7f0a06c6c3ffdfab0b9b29d7f49518
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/408134
Run-TryBot: Tatiana Bradley <tatiana@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Auto-Submit: Tatiana Bradley <tatiana@golang.org>
Reviewed-by: Tatiana Bradley <tatiana@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
diff --git a/reports/GO-2022-0213.yaml b/reports/GO-2022-0213.yaml
new file mode 100644
index 0000000..379d761
--- /dev/null
+++ b/reports/GO-2022-0213.yaml
@@ -0,0 +1,34 @@
+packages:
+ - module: std
+ package: crypto/dsa
+ symbols:
+ - Verify
+ versions:
+ - fixed: 1.12.11
+ - introduced: 1.13.0
+ fixed: 1.13.2
+description: |
+ Invalid DSA public keys can cause a panic in dsa.Verify. In particular,
+ using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a
+ panic, even if the certificates don't chain to a trusted root. The chain
+ can be delivered via a crypto/tls connection to a client, or to a server
+ that accepts and verifies client certificates. net/http clients can be made
+ to crash by an HTTPS server, while net/http servers that accept client
+ certificates will recover the panic and are unaffected.
+
+ Moreover, an application might crash invoking
+ crypto/x509.(*CertificateRequest).CheckSignature on an X.509 certificate
+ request, parsing a golang.org/x/crypto/openpgp Entity, or during a
+ golang.org/x/crypto/otr conversation. Finally, a golang.org/x/crypto/ssh
+ client can panic due to a malformed host key, while a server could panic if
+ either PublicKeyCallback accepts a malformed public key, or if
+ IsUserAuthority accepts a certificate with a malformed public key.
+cves:
+ - CVE-2019-17596
+credit: Daniel Mandragona
+links:
+ pr: https://go.dev/cl/205441
+ commit: https://go.googlesource.com/go/+/552987fdbf4c2bc9641016fd323c3ae5d3a0d9a3
+ context:
+ - https://go.dev/issue/34960
+ - https://groups.google.com/g/golang-announce/c/lVEm7llp0w0/m/VbafyRkgCgAJ
