Skip to content
Sign in
5.9 Medium

CVE-2018-16875 The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for…

Description

The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.

Affected products and versions

Product Affected versions Fixed in
golang 1.11.3 No fix stated
golang 1.10.6 No fix stated

Other CVEs of golang

The 3 CVEs of golang →
CVE-2018-16873 In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when… 7.5 High CVE-2018-16874 In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed… 6.8 Medium
Track this CVE