CVE-2024-24783

2024-03-0523:15:07

Debian Security Bug Tracker

security-tracker.debian.org

cve-2024-24783

certificate chain

public key algorithm

certificate.verify

crypto/tls clients

servers

config.clientauth

verifyclientcertifgiven

requireandverifyclientcert

tls servers

unix

7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.1%

JSON

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

OSVersionArchitecturePackageVersionFilename
Debian10allgolang-1.11<= 1.11.6-1+deb10u4golang-1.11_1.11.6-1+deb10u4_all.deb
Debian11allgolang-1.15<= 1.15.15-1~deb11u4golang-1.15_1.15.15-1~deb11u4_all.deb
Debian12allgolang-1.19<= 1.19.8-2golang-1.19_1.19.8-2_all.deb
Debian999allgolang-1.21< 1.21.8-1golang-1.21_1.21.8-1_all.deb
Debian13allgolang-1.21< 1.21.8-1golang-1.21_1.21.8-1_all.deb
Debian999allgolang-1.22< 1.22.1-1golang-1.22_1.22.1-1_all.deb
Debian13allgolang-1.22< 1.22.1-1golang-1.22_1.22.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	golang-1.11	<= 1.11.6-1+deb10u4	golang-1.11_1.11.6-1+deb10u4_all.deb
Debian	11	all	golang-1.15	<= 1.15.15-1~deb11u4	golang-1.15_1.15.15-1~deb11u4_all.deb
Debian	12	all	golang-1.19	<= 1.19.8-2	golang-1.19_1.19.8-2_all.deb
Debian	999	all	golang-1.21	< 1.21.8-1	golang-1.21_1.21.8-1_all.deb
Debian	13	all	golang-1.21	< 1.21.8-1	golang-1.21_1.21.8-1_all.deb
Debian	999	all	golang-1.22	< 1.22.1-1	golang-1.22_1.22.1-1_all.deb
Debian	13	all	golang-1.22	< 1.22.1-1	golang-1.22_1.22.1-1_all.deb