Описание
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.
An integer overflow vulnerability was found in the Go crypto/x509 and golang.org/x/crypto/cryptobyte libraries on 32-bit architectures. A remote attacker could exploit this by supplying a crafted x.509 certificate, or other ASN.1 structure, as either a client or server to crash vulnerable Go applications.
Отчет
Below products are only supported on 64bit architectures and are therefore not affected by this flaw:
- OpenShift Container Platform
- OpenShift Service Mesh
- Red Hat Ceph Storage
- Red Hat Gluster Storage
- Container-native Virtualization
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Service Mesh 1 | jaeger | Not affected | ||
| OpenShift Service Mesh 1 | jaeger-operator | Not affected | ||
| OpenShift Service Mesh 1 | kiali | Not affected | ||
| OpenShift Service Mesh 1 | servicemesh | Not affected | ||
| OpenShift Service Mesh 1 | servicemesh-cni | Not affected | ||
| OpenShift Service Mesh 1 | servicemesh-operator | Not affected | ||
| OpenShift Service Mesh 1 | servicemesh-prometheus | Not affected | ||
| Red Hat Ceph Storage 2 | golang | Not affected | ||
| Red Hat Ceph Storage 3 | golang | Not affected | ||
| Red Hat Ceph Storage 3 | grafana | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte ...
Helm uses crypto package vulnerable to panic from malformed X.509 certificate
Уязвимость библиотек crypto/x509 и golang.org/x/crypto/cryptobyte языка программирования GO, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3