REDHAT-BUG-2484207: High severity go crypto/x509 (Certificate.VerifyHostname / VerifyHostname via Verify) vulnerability
(x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2484207?
The severity of REDHAT-BUG-2484207 is high with a score of 7.
How do I fix REDHAT-BUG-2484207?
To fix REDHAT-BUG-2484207, update to the latest version of the Go crypto/x509 package.
What impact does REDHAT-BUG-2484207 have on systems?
REDHAT-BUG-2484207 can lead to increased resource consumption and performance degradation during hostname verification.
In which function does REDHAT-BUG-2484207 occur?
REDHAT-BUG-2484207 occurs in the (*x509.Certificate).VerifyHostname function.
Is there a known workaround for REDHAT-BUG-2484207?
Currently, there are no known workarounds for REDHAT-BUG-2484207 other than applying the software update.