CVE-2020-7919: Vulnerability in golang package allows attacks on clients via a malformed X.509 certificate
Summary
CVE-2020-7919: Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate. Affects golang across 2 version ranges.
>= 1.12.0, < 1.12.6
>= 1.13.0, < 1.13.7
Fixed in 1.12.6 or 1.13.7, depending on the release line you run. How to fix ↓
Also tracked for
- stdlib · Go
- github.com/helm/helm · Go
The same CVE-2020-7919 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package is a popular open-source programming language that provides a platform for building efficient and scalable software. It is widely used for developing various applications, including web servers, network tools, and system utilities. The package offers a rich set of libraries and tools that enable developers to create robust and secure applications. However, a vulnerability has been discovered in versions before 1.12.16 and 1.13.x before 1.13.7, which can be exploited by attackers using a malformed X.509 certificate to cause a panic in clients.
Vulnerability Detail
The vulnerability in the golang package arises from a flaw in the crypto/cryptobyte package. When processing X.509 certificates, the package fails to handle malformed certificates correctly, leading to a panic in clients. This panic can result in a denial of service (DoS) condition, disrupting the normal operation of affected applications. Attackers can exploit this vulnerability by crafting specially crafted X.509 certificates and presenting them to vulnerable applications. The impact of this vulnerability can be severe, as it allows remote attackers to crash applications and potentially disrupt critical services.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.12.0, < 1.12.61.12.6 -
>= 1.13.0, < 1.13.71.13.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched versions of the golang package as soon as possible.
Conclusion
The vulnerability in the golang package allows attackers to exploit a flaw in the crypto/cryptobyte package, resulting in a panic in clients. This can lead to a denial of service (DoS) condition and potential disruption of critical services. It is crucial for developers to update their applications to the latest patched versions of the golang package and regularly check for updates to mitigate the risk of known vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability allows attackers to cause a panic in clients by exploiting a flaw in the golang package. It can result in a denial of service (DoS) condition, potentially disrupting the normal operation of affected applications.
Attackers can exploit this vulnerability by crafting specially crafted X.509 certificates and presenting them to vulnerable applications. This can be done remotely, allowing attackers to crash applications and potentially disrupt critical services.
No, only versions before 1.12.16 and 1.13.x before 1.13.7 are affected. It is recommended to update to the latest patched versions to mitigate the risk.
No, there is no known workaround for this vulnerability. It is crucial to update to the patched versions of the golang package as soon as possible.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will alert you in real-time if any open-source vulnerabilities, including this one, are detected.
Related vulnerabilities
Recent vulnerabilities recorded for golang.
