Описание
Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| golang-1.25 | fixed | 1.25.2-1 | package | |
| golang-1.24 | fixed | 1.24.8-1 | package | |
| golang-1.24 | no-dsa | trixie | package | |
| golang-1.23 | removed | package | ||
| golang-1.19 | removed | package | ||
| golang-1.19 | no-dsa | bookworm | package | |
| golang-1.15 | removed | package | ||
| golang-1.15 | postponed | bullseye | package |
Примечания
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI/m/qZN5nc-mBgAJ
https://github.com/golang/go/issues/75671
https://github.com/golang/go/commit/e0f655bf3f96410f90756f49532bc6a1851855ca (go1.25.2)
https://github.com/golang/go/commit/5c3d61c886f7ecfce9a6d6d3c97e6d5a8afb17d1 (go1.24.8)
EPSS
Процентиль: 5%
0.00025
Низкий
Связанные уязвимости
CVSS3: 5.3
ubuntu
27 дней назад
[encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion]
CVSS3: 5.3
nvd
7 дней назад
Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.
CVSS3: 5.3
github
7 дней назад
Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.
EPSS
Процентиль: 5%
0.00025
Низкий