Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2024-24783

Verify panics on certificates with an unknown public key algorithm in crypto/x509

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library crypto/x509

Default version status: unaffected

  • 0 to < 1.21.8affected
  • 1.22.0-0 to < 1.22.1affected

References