CVE-2020-28362: Input Validation
A flaw was found in the math/big package of Go's standard library that causes a denial of service. Applications written in Go that use math/big via cryptographic packages, including crypto/rsa and crypto/x509, are vulnerable and can potentially cause panic via a crafted certificate chain. The highest threat from this vulnerability is to system availability.
Other sources
A number of math/big.Int methods (Div, Exp, DivMod, Quo, Rem, QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD) can panic when provided crafted large inputs. For the panic to happen, the divisor or modulo argument must be larger than 3168 bits (on 32-bit architectures) or 6336 bits (on 64-bit architectures). Multiple math/big.Rat methods are similarly affected.
References: https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM/m/fLguyiM2CAAJ https://github.com/golang/go/issues/42552
— Red Hat
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
Golang Go is vulnerable to a denial of service, caused by improper input validation by the math/big.Int methods. By sending a specially-crafted inputs, a remote attacker could exploit this vulnerability to cause the application to crash.
— IBM
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-28362?
The severity of CVE-2020-28362 is high.
Which software versions are affected by CVE-2020-28362?
Go versions before 1.14.12 and 1.15.x before 1.15.4 are affected.
How does CVE-2020-28362 cause a denial of service?
CVE-2020-28362 causes a denial of service by allowing an attacker to craft a certificate chain that can trigger a panic in applications using math/big via cryptographic packages.
How can I fix CVE-2020-28362?
To fix CVE-2020-28362, update to Go version 1.15.5 or 1.14.12, depending on the affected version.
Where can I find more information about CVE-2020-28362?
You can find more information about CVE-2020-28362 on the CVE website (CVE-2020-28362), the NVD (CVE-2020-28362), and the Red Hat bugzilla and errata pages.