CVE-2024-24783: Vulnerability in stdlib package - Verify panics on certificates with an unknown public key algorithm
Summary
CVE-2024-24783: Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. Affects golang-1.15 versions 1.15.15-1 – 1.15.9-6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package is a standard library in the Go programming language. It provides essential functions and types for various purposes, including cryptography. The package includes the crypto/x509 module, which is responsible for handling X.509 certificates. X.509 is a standard format for public key certificates used in many cryptographic protocols. The vulnerability in the stdlib package affects the Verify function in the crypto/x509 module, causing it to panic when encountering a certificate with an unknown public key algorithm.
Vulnerability Detail
The vulnerability arises when verifying a certificate chain that contains a certificate with an unknown public key algorithm. This triggers a panic in the Certificate.Verify function. The impact of this vulnerability is significant as it affects all crypto/tls clients and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. By default, TLS servers do not verify client certificates, but if this configuration is enabled, the vulnerability can be exploited. The vulnerability has a CVSS score of 5.9, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by not enabling client certificate verification in their TLS servers. By default, client certificate verification is disabled, so if it is not explicitly enabled, the vulnerability does not pose a threat.
Conclusion
In conclusion, the stdlib package in Go is vulnerable to a panic when verifying certificates with an unknown public key algorithm. This vulnerability can be mitigated by updating to the fixed versions of the package. It is recommended to stay updated with the latest security patches and follow best practices for secure coding. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The impact of this vulnerability is significant as it affects all crypto/tls clients and servers that enable client certificate verification. It can lead to a panic in the Certificate.Verify function, causing denial of service or other unexpected behavior.
To fix this vulnerability, update the stdlib package to version 1.21.8 or 1.22.1. Make sure to update your Go dependencies to include the fixed version of the package.
While there is no specific workaround mentioned, you can mitigate the risk by not enabling client certificate verification in your TLS servers. By default, client certificate verification is disabled.
The vulnerability affects stdlib package versions up to 1.18.2. Versions 1.21.8 and 1.22.1 have the fix for this vulnerability.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2024-24783
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
