CVE-2024-24783

Published: Mar 5, 2024Modified: Jun 17, 2026Deferred

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.2 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

Related CWEs

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (12)

http://www.openwall.com/lists/oss-security/2024/03/08/4

Source: security@golang.org

https://go.dev/cl/569339

Source: security@golang.org

https://go.dev/issue/65390

Source: security@golang.org

https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg

Source: security@golang.org

https://pkg.go.dev/vuln/GO-2024-2598

Source: security@golang.org

https://security.netapp.com/advisory/ntap-20240329-0005/

Source: security@golang.org

http://www.openwall.com/lists/oss-security/2024/03/08/4

Source: af854a3a-2127-422b-91ae-364da2661108

https://go.dev/cl/569339

Source: af854a3a-2127-422b-91ae-364da2661108

https://go.dev/issue/65390

Source: af854a3a-2127-422b-91ae-364da2661108

https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg

Source: af854a3a-2127-422b-91ae-364da2661108

https://pkg.go.dev/vuln/GO-2024-2598

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20240329-0005/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.