The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange allowing a malicious TLS server to cause a TLS client to panic.

🗓️ 31 Jul 2021 07:00:00Reported by MicrosoftType

Go language crypto tls 1.16.5 fails to verify public key type in x509 during rsa key exchange, causing a panic in the client.

Reporter	Title	Published	Views	Family All 282
IBM Security Bulletins	Security Bulletin: Operations Dashboard is vulnerable to multiple Go vulnerabilities	14 Oct 202113:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been found in Golang Go which is shipped with Cloud Pak System	6 May 202219:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities	7 Apr 202219:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go	1 Oct 202106:19	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in PostgreSQL, Apache, Golang Go, and Linux Kernel affect IBM Spectrum Copy Data Management	10 Dec 202123:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Integration is vulnerable to multiple Go vulnerabilities	15 Oct 202113:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to several issues due to the go compiler ( CVE-2022-41724 CVE-2021-34558 )	8 Aug 202419:58	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in Go affect IBM Cloud Pak for Multicloud Management Hybrid GRC.	23 Dec 202119:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rapid Infrastructure Automation	29 Apr 202502:39	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability in Golang Go affects IBM Cloud Automation Manager	16 Sep 202118:09	–	ibm

Vulners

Node

31 Jul 2021 07:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 22.6

CVSS 3.16.5

EPSS0.06975