Описание
Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| golang-1.25 | fixed | 1.25.2-1 | package | |
| golang-1.24 | fixed | 1.24.8-1 | package | |
| golang-1.24 | no-dsa | trixie | package | |
| golang-1.23 | removed | package | ||
| golang-1.19 | removed | package | ||
| golang-1.19 | no-dsa | bookworm | package | |
| golang-1.15 | removed | package | ||
| golang-1.15 | postponed | bullseye | package |
Примечания
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI/m/qZN5nc-mBgAJ
https://github.com/golang/go/issues/75671
https://github.com/golang/go/commit/e0f655bf3f96410f90756f49532bc6a1851855ca (go1.25.2)
https://github.com/golang/go/commit/5c3d61c886f7ecfce9a6d6d3c97e6d5a8afb17d1 (go1.24.8)
Связанные уязвимости
Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.
Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.
Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.
Уязвимость компонента encoding/asn1 языка программирования Go, позволяющая нарушителю вызвать отказ в обслуживании