blob: 379d7619ac085a962e0b150951023e48ca3ec270 [file] [log] [blame]
- module: std
package: crypto/dsa
- Verify
- fixed: 1.12.11
- introduced: 1.13.0
fixed: 1.13.2
description: |
Invalid DSA public keys can cause a panic in dsa.Verify. In particular,
using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a
panic, even if the certificates don't chain to a trusted root. The chain
can be delivered via a crypto/tls connection to a client, or to a server
that accepts and verifies client certificates. net/http clients can be made
to crash by an HTTPS server, while net/http servers that accept client
certificates will recover the panic and are unaffected.
Moreover, an application might crash invoking
crypto/x509.(*CertificateRequest).CheckSignature on an X.509 certificate
request, parsing a Entity, or during a conversation. Finally, a
client can panic due to a malformed host key, while a server could panic if
either PublicKeyCallback accepts a malformed public key, or if
IsUserAuthority accepts a certificate with a malformed public key.
- CVE-2019-17596
credit: Daniel Mandragona