Aller au contenu
Se connecter
5.9 Moyenne

CVE-2018-16875 The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for…

Description

The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.

Produits et versions touchés

Produit Versions touchées Corrigé en
golang 1.11.3 Pas de correctif indiqué
golang 1.10.6 Pas de correctif indiqué

Autres CVE de golang

Les 3 CVE de golang →
CVE-2018-16873 In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when… 7.5 Élevée CVE-2018-16874 In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed… 6.8 Moyenne
Suivre cette CVE