Published: 14/12/2018 Updated: 07/11/2023

CVSS v2 Base Score: 7.8 | Impact Score: 6.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 694

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

The crypto/x509 package of Go prior to 1.10.6 and 1.11.x prior to 1.11.3 does not limit the amount of work performed for each chain verification, which might allow malicious users to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.

Vulnerable Product	Search on Vulmon	Subscribe to Product
golang go
opensuse leap 42.3

In Go before 1106 and 111x before 1113, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at http ...

The crypto/x509 package of Go before 1106 and 111x before 1113 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service Go TLS servers accepting client certificates and TLS clients are affected ...

tlsserver this code is referenced from githubcom/alexzorin/poc-cve-2018-16875 generate certificate chain and start tls server args: -inters 10 intermidiates certificates count -noserver only generate certificate, not start tls server -notgencert use current cert dir, not regenerate -domain DNS in certificate -port port for tls server to listen on eg: /

CWE-295 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16875 http://www.securityfocus.com/bid/106230 https://security.gentoo.org/glsa/201812-09 http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0 https://nvd.nist.gov https://github.com/stanal/tlsserver https://alas.aws.amazon.com/ALAS-2018-1130.html

CVE-2018-16875

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect