CVE-2018-16875
- State
- Published
- Severity
- 5.9 Medium
- Published
- Dec 14, 2018
- Updated
- Aug 5, 2024
- Reserved
- Sep 11, 2018
Description
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 5.9 Medium | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | redhat |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
golang[UNKNOWN] |
|
References
- 106230vdb-entry
- GLSA-201812-09vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16875
- https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0
- openSUSE-SU-2019:1079vendor-advisory
- openSUSE-SU-2019:1444vendor-advisory
- openSUSE-SU-2019:1499vendor-advisory
- openSUSE-SU-2019:1506vendor-advisory
- openSUSE-SU-2019:1703vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.