CVE-2018-16875: Input Validation
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-16875?
CVE-2018-16875 is classified as a denial of service vulnerability due to its potential to allow attackers to craft inputs that consume excessive CPU resources.
How do I fix CVE-2018-16875?
To fix CVE-2018-16875, update your Go installation to version 1.10.6 or later if using 1.10.x, or to version 1.11.3 or later if using 1.11.x.
What versions of Go are affected by CVE-2018-16875?
CVE-2018-16875 affects Go versions prior to 1.10.6 and those from 1.11.0 to 1.11.2.
What kind of attack does CVE-2018-16875 enable?
CVE-2018-16875 enables a CPU denial of service attack through specially crafted inputs during chain verification.
What is the impact of exploiting CVE-2018-16875?
Exploiting CVE-2018-16875 could lead to significant CPU resource exhaustion on servers handling TLS connections.