REDHAT-BUG-2342464: High severity go Go crypto/x509 vulnerability
Published Jan 28, 2025
·Updated
Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.
Affected Software
1 affected component
go Go crypto/x509
Event History
Jan 28, 2025
Data Sourced
via Red Hat·02:01 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of REDHAT-BUG-2342464?
The severity of REDHAT-BUG-2342464 is considered to be critical due to the potential for a panic when verifying malformed RSA keys.
2
How do I fix REDHAT-BUG-2342464?
To fix REDHAT-BUG-2342464, ensure that RSA keys are well-formed and include the necessary CRT values before parsing.
3
What software is affected by REDHAT-BUG-2342464?
REDHAT-BUG-2342464 affects software that utilizes the ParsePKCS1PrivateKey function to parse RSA keys without CRT values.
4
What happens if I encounter REDHAT-BUG-2342464?
If REDHAT-BUG-2342464 is encountered, the system may panic, causing disruptions and potential security issues.
5
Is there a workaround for REDHAT-BUG-2342464?
A possible workaround for REDHAT-BUG-2342464 is to validate RSA keys to ensure they include all required components before parsing.