CVE-2022-27536

HIGH7.5EPSS 0.56%

Panic during certificate parsing on Darwin in crypto/x509

發布日:2022/5/23修改日:2025/4/3

描述

Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.

受影響套件(2)

Bitnami/golang>= 1.18.0, < 1.18.1
Go/stdlib>= 1.18.0-0, < 1.18.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

參考連結(9)

PATCHhttps://go.dev/cl/393655
PATCHhttps://go.googlesource.com/go/+/0fca8a8f25cf4636fd980e72ba0bded4230922de
REPORThttps://go.dev/issue/51759
WEBhttps://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
WEBhttps://groups.google.com/g/golang-announce
WEBhttps://groups.google.com/g/golang-announce/c/oecdBNLOml8
WEBhttps://nvd.nist.gov/vuln/detail/CVE-2022-27536
WEBhttps://security.gentoo.org/glsa/202208-02
WEBhttps://security.netapp.com/advisory/ntap-20230309-0001/