CVEvulnerability
CVE-2018-16875
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-12-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.9 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 7.8 HIGH — AV:N/AC:L/Au:N/C:N/I:N/A:C
- Weaknesses
- CWE-20, CWE-295
Description
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.
Affected configurations
• golang go (< 1.10.6)
• golang go (>= 1.11.0 < 1.11.3)
• opensuse leap 42.3
Related
References
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html lists.opensuse.org
- http://www.securityfocus.com/bid/106230 Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16875 Issue Tracking, Third Party Advisory
- https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0 groups.google.com
- https://security.gentoo.org/glsa/201812-09 Mitigation, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html lists.opensuse.org
- http://www.securityfocus.com/bid/106230 Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16875 Issue Tracking, Third Party Advisory
- https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0 groups.google.com
- https://security.gentoo.org/glsa/201812-09 Mitigation, Third Party Advisory