CVE-2024-24783 Verify panics on certificates with an unknown public key algorithm in crypto/x509
A remote attacker can cause a denial of service by sending a certificate with an unknown public key algorithm to a Go TLS client or server configured to verify client certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-24783?
CVE-2024-24783 is a medium-severity vulnerability in Go standard library crypto/x509, published on 5 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.
Weakness: CWE-476
Which versions are affected by CVE-2024-24783?
2 open source packages ship an affected version, including golang and stdlib.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.21.8, 1.22.1 |
stdlib Go | All versions | 1.21.8, 1.22.1 |
Linux distribution packages (25)
buildah AlmaLinux:9 | All versions | 2:1.33.7-4.el9_4 |
buildah-tests AlmaLinux:9 | All versions | 2:1.33.7-4.el9_4 |
containernetworking-plugins AlmaLinux:9 | All versions | 1:1.4.0-5.el9_4 |
gvisor-tap-vsock AlmaLinux:9 | All versions | 6:0.7.3-5.el9_4.alma.1 |
runc AlmaLinux:9 | All versions | 4:1.1.12-4.el9_4 |
skopeo AlmaLinux:9 | All versions | 2:1.14.5-1.el9_4 |
skopeo-tests AlmaLinux:9 | All versions | 2:1.14.5-1.el9_4 |
buildah Red Hat:enterprise_linux:9::appstream | All versions | 2:1.33.7-4.el9_4 |
buildah-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:1.33.7-4.el9_4 |
buildah-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 2:1.33.7-4.el9_4 |
buildah-tests Red Hat:enterprise_linux:9::appstream | All versions | 2:1.33.7-4.el9_4 |
buildah-tests-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:1.33.7-4.el9_4 |
containernetworking-plugins Red Hat:enterprise_linux:9::appstream | All versions | 1:1.4.0-5.el9_4 |
containernetworking-plugins-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:1.4.0-5.el9_4 |
containernetworking-plugins-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 1:1.4.0-5.el9_4 |
gvisor-tap-vsock Red Hat:enterprise_linux:9::appstream | All versions | 6:0.7.3-5.el9_4 |
gvisor-tap-vsock-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 6:0.7.3-5.el9_4 |
gvisor-tap-vsock-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 6:0.7.3-5.el9_4 |
runc Red Hat:enterprise_linux:9::appstream | All versions | 4:1.1.12-4.el9_4 |
runc-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 4:1.1.12-4.el9_4 |
runc-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 4:1.1.12-4.el9_4 |
skopeo Red Hat:enterprise_linux:9::appstream | All versions | 2:1.14.5-1.el9_4 |
skopeo-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:1.14.5-1.el9_4 |
skopeo-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 2:1.14.5-1.el9_4 |
skopeo-tests Red Hat:enterprise_linux:9::appstream | All versions | 2:1.14.5-1.el9_4 |
How do I fix CVE-2024-24783?
Upgrade golang to a fixed version for your release line: 1.21.8 or 1.22.1.
Is CVE-2024-24783 being exploited?
There is no known exploitation of CVE-2024-24783 in the wild and no public exploit code.
Sources
Also known as ALSA-2024:6186, ALSA-2024:6187, ALSA-2024:6188, ALSA-2024:6189, ALSA-2024:6195, AZL-37320 and 17 more.