PT-2024-2139 · Debian+10 · Debian+10
John Howard
·
Published
2024-03-05
·
Updated
2025-06-27
·
CVE-2024-24783
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
crypto/tls versions (affected versions not specified)
golang (affected versions not specified)
Description
The issue arises when verifying a certificate chain that contains a certificate with an unknown public key algorithm, causing Certificate.Verify to panic. This affects all crypto/tls clients and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior for TLS servers is to not verify client certificates. There is also a mention of a vulnerability in the golang package of the Debian GNU/Linux operating system related to insufficient exception handling, which can be exploited by a remote attacker to cause a denial of service (DoS).
Recommendations
For crypto/tls, consider disabling the Certificate.Verify function until a patch is available to prevent panic when encountering unknown public key algorithms.
For golang, restrict the use of the vulnerable package to minimize the risk of exploitation until a fix is provided.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu