FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

go -- multiple vulnerabilities

Affected packages
go < 1.18.1,1
go117 < 1.17.9,1

Details

VuXML ID 61bce714-ca0c-11ec-9cfc-10c37b4ac2ea
Discovery 2022-04-12
Entry 2022-05-02

The Go project reports:

encoding/pem: fix stack overflow in Decode.

A large (more than 5 MB) PEM input can cause a stack overflow in Decode, leading the program to crash.

crypto/elliptic: tolerate all oversized scalars in generic P-256.

A crafted scalar input longer than 32 bytes can cause P256().ScalarMult or P256().ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected.

crypto/x509: non-compliant certificates can cause a panic in Verify on macOS in Go 1.18.

Verifying certificate chains containing certificates which are not compliant with RFC 5280 causes Certificate.Verify to panic on macOS. These chains can be delivered through TLS and can cause a crypto/tls or net/http client to crash.

References

CVE Name CVE-2022-24675
CVE Name CVE-2022-27536
CVE Name CVE-2022-28327
URL https://github.com/golang/go/issues/51759
URL https://github.com/golang/go/issues/51853
URL https://github.com/golang/go/issues/52075