REDHAT-BUG-2456333: Medium severity Google Go crypto/x509 vulnerability
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure certificate verification to supply a curated VerifyOptions.Roots CertPool containing only explicitly trusted root CAs instead of relying on the system certificate pool to reduce exposure to chains with many policy mappings.
VerifyOptions.Roots CertPool Roots = use a curated CertPool (do not rely on the system certificate pool) - Compensating control
Restrict trust in the system certificate store and any CertPools used by the application to a minimal set of required root CAs (remove or disable unnecessary/untrusted root CAs) to mitigate the risk of denial-of-service from certificate chains with large numbers of policy mappings.