Описание
Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| golang-1.24 | fixed | 1.24~rc2-1 | package | |
| golang-1.23 | not-affected | package | ||
| golang-1.22 | not-affected | package | ||
| golang-1.19 | not-affected | package | ||
| golang-1.15 | not-affected | package |
Примечания
https://go-review.googlesource.com/c/go/+/643098
https://github.com/golang/go/issues/71216
https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ
Fixed by: https://github.com/golang/go/commit/3de5aca7d00ac7d2c8a29e1300446e89453a (go1.24rc2)
https://github.com/golang/go/issues/71216#issuecomment-2620109068
Связанные уязвимости
Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.
Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.
Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.
Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.
Уязвимость функции ParsePKCS1PrivateKey библиотеки crypto/x509 языка программирования Go, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации