CVE-2024-24783
MediumSummary
A vulnerability in Go's crypto/tls library causes a panic when verifying a certificate chain containing a certificate with an unknown public key algorithm. This affects all TLS clients and servers with client certificate verification enabled.
Risk Assessment
An attacker can cause a denial of service (DoS) by triggering a panic in applications using crypto/tls, especially servers that require client certificate verification.
Recommendation
Immediately update Go to a patched version (e.g., 1.22.1 or 1.21.8) and rebuild all applications using crypto/tls.
Original NVD description (English source)
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TL