Panic in Certificate Verification in golang
Summary
CVE-2024-24783: Verify panics on certificates with an unknown public key algorithm in crypto/x509. Affects golang across 2 version ranges.
< 1.21.8
>= 1.22.0-0, < 1.22.1
Fixed in 1.21.8 or 1.22.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2024-24783 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package is a popular open-source programming language that provides a robust set of tools and libraries for building scalable and efficient applications. It is widely used for developing network applications, including secure communication protocols. However, a vulnerability has been discovered in the golang package that affects the certificate verification process in crypto/tls clients and servers. This vulnerability can lead to a panic condition, potentially causing denial of service or other security issues.
Vulnerability Detail
The vulnerability arises when a certificate chain contains a certificate with an unknown public key algorithm. When the Certificate.Verify function is called to verify the chain, it triggers a panic, resulting in the termination of the program. This vulnerability affects all crypto/tls clients and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. By default, TLS servers do not verify client certificates, but if this configuration is enabled, the vulnerability can be exploited. The impact of this vulnerability can range from service disruption to potential security breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.21.81.21.8 -
>= 1.22.0-0, < 1.22.11.22.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a possible workaround is to disable client certificate verification by setting Config.ClientAuth to NoClientCert. However, this workaround should be used with caution as it may compromise the security of the application. Here is an example of how to implement the workaround in code:
c := &tls.Config{
ClientAuth: tls.NoClientCert,
}
Conclusion
The golang package is vulnerable to a certificate verification panic condition, which can lead to service disruption or security breaches. It is crucial to update to version 1.22.1 or later to fix this vulnerability. If immediate updating is not possible, disabling client certificate verification can serve as a temporary workaround. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
The vulnerability affects all versions of the golang package prior to version 1.22.1.
By default, TLS servers do not verify client certificates. This vulnerability only affects servers that have enabled client certificate verification by setting Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert.
The vulnerability can lead to a panic condition, causing denial of service or other security issues. It may also allow attackers to bypass client certificate verification and gain unauthorized access to the server.
Yes, the golang community has addressed this issue and provided a fix in version 1.22.1. It is recommended to update to the latest version to mitigate the vulnerability.
Yes, a possible workaround is to disable client certificate verification by setting Config.ClientAuth to NoClientCert. However, this workaround should be used with caution as it may compromise the security of the application.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
