REDHAT-BUG-2456339: High severity go crypto/x509 vulnerability
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not pass a large number of intermediate certificates in VerifyOptions.Intermediates. Enforce a maximum number of intermediates (maximum chain length) in your application before calling Verify to limit the amount of work done during chain building and mitigate this denial-of-service condition.
crypto/x509 VerifyOptions (Go) Intermediates = limit number of intermediate certificates passed
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2456339?
The severity of REDHAT-BUG-2456339 is classified as a denial of service vulnerability.
How do I fix REDHAT-BUG-2456339?
To fix REDHAT-BUG-2456339, ensure that your implementation of crypto/x509 and crypto/tls is updated to the latest patched version.
What software is affected by REDHAT-BUG-2456339?
REDHAT-BUG-2456339 affects the Go libraries crypto/x509 and crypto/tls.
What type of vulnerability is REDHAT-BUG-2456339?
REDHAT-BUG-2456339 is a denial of service vulnerability caused by improper limitations during chain building.
Who can be impacted by REDHAT-BUG-2456339?
Direct users of the Go crypto/x509 and crypto/tls libraries can be impacted by REDHAT-BUG-2456339.