CVE-2024-24783

Name of the Vulnerable Software and Affected Versions crypto/tls versions (affected versions not specified) golang (affected versions not specified)

Description The issue arises when verifying a certificate chain that contains a certificate with an unknown public key algorithm, causing Certificate.Verify to panic. This affects all crypto/tls clients and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior for TLS servers is to not verify client certificates. There is also a mention of a vulnerability in the golang package of the Debian GNU/Linux operating system related to insufficient exception handling, which can be exploited by a remote attacker to cause a denial of service (DoS).

Recommendations For crypto/tls, consider disabling the Certificate.Verify function until a patch is available to prevent panic when encountering unknown public key algorithms. For golang, restrict the use of the vulnerable package to minimize the risk of exploitation until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.