CVE-2024-24783: Verify panics on certificates with an unknown public key algorithm in crypto/x509
Last updated 14 November 2024
Other sources
Verify panics on certificates with an unknown public key algorithm in crypto/x509
— Microsoft
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic.
This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.
https://github.com/golang/go/issues/65390
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24783?
CVE-2024-24783 has a high severity rating due to its potential to cause denial of service by exploiting flaws in the crypto/x509 package.
How do I fix CVE-2024-24783?
To mitigate CVE-2024-24783, upgrade to Go version 1.21.8 or higher, or to 1.22.1 or higher, depending on your distribution.
Which versions of IBM Concert Software are affected by CVE-2024-24783?
IBM Concert Software versions 1.0.0 to 1.0.2.1 are vulnerable to CVE-2024-24783.
What packages in Debian are impacted by CVE-2024-24783?
The vulnerable packages in Debian are golang-1.15 up to version 1.15.15-1~deb11u4 and golang-1.19 up to version 1.19.8-2.
Is there a workaround for CVE-2024-24783?
Currently, there is no known workaround for CVE-2024-24783; upgrading to a patched version is the recommended solution.