CVE-2022-27536
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.
02 / AFFECTED SOFTWARE
Affected packages
137 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.
Verifying certificate chains containing certificates which are not compliant with RFC 5280 causes Certificate.Verify to panic on macOS. These chains can be delivered through TLS and can cause a crypto/tls or net/http client to crash.
05 / REFERENCES
Further evidence
- https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27536.json
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/oecdBNLOml8
- https://nvd.nist.gov/vuln/detail/CVE-2022-27536
- https://security.gentoo.org/glsa/202208-02
- https://security.netapp.com/advisory/ntap-20230309-0001/
- https://go.dev/cl/393655
- https://go.dev/issue/51759
- https://go.googlesource.com/go/+/0fca8a8f25cf4636fd980e72ba0bded4230922de