| Tatiana Bradley | f1409b0 | 2023-05-24 14:02:12 -0400 | [diff] [blame] | 1 | id: GO-2022-0213 |
| Damien Neil | b5cb765 | 2022-08-18 15:09:12 -0700 | [diff] [blame] | 2 | modules: |
| Tatiana Bradley | 82175fd | 2023-05-31 17:04:08 -0400 | [diff] [blame] | 3 | - module: std |
| 4 | versions: |
| 5 | - fixed: 1.12.11 |
| 6 | - introduced: 1.13.0-0 |
| 7 | fixed: 1.13.2 |
| 8 | vulnerable_at: 1.13.1 |
| 9 | packages: |
| 10 | - package: crypto/dsa |
| 11 | symbols: |
| 12 | - Verify |
| 13 | skip_fix: 'TODO: revisit this reason (fix appears to not work with Go <1.18)' |
| Tatiana Bradley | b4465ba | 2023-05-10 11:24:18 -0400 | [diff] [blame] | 14 | summary: Panic on invalid DSA public keys in crypto/dsa |
| Tatiana Bradley | ccdac2d | 2023-06-22 13:27:05 -0400 | [diff] [blame] | 15 | description: |- |
| 16 | Invalid DSA public keys can cause a panic in dsa.Verify. In particular, using |
| 17 | crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, |
| 18 | even if the certificates don't chain to a trusted root. The chain can be |
| 19 | delivered via a crypto/tls connection to a client, or to a server that accepts |
| 20 | and verifies client certificates. net/http clients can be made to crash by an |
| 21 | HTTPS server, while net/http servers that accept client certificates will |
| 22 | recover the panic and are unaffected. |
| Tatiana Bradley | 555d995 | 2022-05-24 11:58:05 -0400 | [diff] [blame] | 23 | |
| 24 | Moreover, an application might crash invoking |
| 25 | crypto/x509.(*CertificateRequest).CheckSignature on an X.509 certificate |
| 26 | request, parsing a golang.org/x/crypto/openpgp Entity, or during a |
| Tatiana Bradley | ccdac2d | 2023-06-22 13:27:05 -0400 | [diff] [blame] | 27 | golang.org/x/crypto/otr conversation. Finally, a golang.org/x/crypto/ssh client |
| 28 | can panic due to a malformed host key, while a server could panic if either |
| 29 | PublicKeyCallback accepts a malformed public key, or if IsUserAuthority accepts |
| 30 | a certificate with a malformed public key. |
| Damien Neil | 95a417d | 2022-08-17 15:39:45 -0700 | [diff] [blame] | 31 | published: 2022-05-24T20:14:11Z |
| Tatiana Bradley | 555d995 | 2022-05-24 11:58:05 -0400 | [diff] [blame] | 32 | cves: |
| Tatiana Bradley | 82175fd | 2023-05-31 17:04:08 -0400 | [diff] [blame] | 33 | - CVE-2019-17596 |
| Tatiana Bradley | 0910814 | 2023-05-18 16:23:32 -0400 | [diff] [blame] | 34 | credits: |
| Tatiana Bradley | 82175fd | 2023-05-31 17:04:08 -0400 | [diff] [blame] | 35 | - Daniel M |
| 36 | - ragona |
| Damien Neil | 00e94d7 | 2022-08-26 14:59:35 -0700 | [diff] [blame] | 37 | references: |
| Tatiana Bradley | 82175fd | 2023-05-31 17:04:08 -0400 | [diff] [blame] | 38 | - fix: https://go.dev/cl/205441 |
| 39 | - fix: https://go.googlesource.com/go/+/552987fdbf4c2bc9641016fd323c3ae5d3a0d9a3 |
| 40 | - report: https://go.dev/issue/34960 |
| 41 | - web: https://groups.google.com/g/golang-announce/c/lVEm7llp0w0/m/VbafyRkgCgAJ |
