CVE-2020-9283

CVE-2020-9283 익스플로잇 이 프로젝트는 다음에서 찾을 수 있는 원본 PoC에서 영감을 받았습니다. github.com/mark-adams/exploits/CVE-2020-9283. Go SSH 라이브러리가 어떻게 구현되었는지 궁금해서 Go를 사용하여 PoC를 구현하기로 결정했습니다. 간단한 설명은 여기에서 확인할 수 있습니다 https://dev.to/brompwnie/modifying-go-s-crypto-ssh-library-for-cve-2020-9283-26a7 이것은 무엇을 하나요? 이것은 Go 기반 SSH...

dsa

Goのcrypto/dsa脆弱性（CVE-2016-3959）の概要 Alex Mullins 2016年4月9日 はじめに 最近、Goプログラミング言語用のDigital Signature Algorithm（DSA）暗号ライブラリにバグが発見されました。この記事では、このバグの詳細と、攻撃者がこれを利用して、クライアント認証に基礎となるDSAライブラリを使用する標準的なGo SSHサーバーに対してサービス拒否攻撃を仕掛ける方法について説明します。 この脆弱性が最初に言及されたのは、Open Source Security（oss-sec）メーリングリストの投稿...

cve-2021-34558

CVE-2021-34558 の PoC Run the malicious TLS server go run main.go -mode server Run a normal http.Get client call against the server which panics go run main.go -mode client ./vendor/github.com/refraction-networking/utls/handshakeserver.go に、一致しない証明書/暗号方式で悪意のあるハンドシェイクを送信できるようにするための軽微な変更が加えられています。...

CVE-2023-29409

CVE-2023-29409 $ openssl genrsa -out ca-key.pem 2048 $ openssl req -x509 -new -nodes -key ca-key.pem -sha256 -days 100000 -out ca.pem \ -addext 'keyUsage=keyCertSign' \ -subj '/CN=Root CA' $ go run main.go server in the background $ go run main.go client causes high cpu load on client $ go run...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

Astra Linux – Vulnerability in golang-go.crypto

The x/crypto/ssh package in version 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to cause a panic in an SSH server...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

RHEL 10 : yggdrasil (RHSA-2026:67134)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67134 advisory. yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child worker...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

ALSA-2026:66364 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

RHEL 9 : Red Hat OpenStack Platform 17.1 security advisory (Important) (RHSA-2026:66401)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:66401 advisory. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service...