p PatchFirst

CVE-2018-16875

CVE-2018-16875

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.

CVSS 5.9 · Medium · EPSS 6.5%

Published
Updated

Stack: system

Affected products and versions

  • golang

    Versions
    • 1.10.6: Affected
    • 1.11.3: Affected

    No fix published

  • golang-1.10 Ubuntu:14.04:LTS

    Versions
    • 1.10.4-2ubuntu1~14.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.10 Ubuntu:16.04:LTS

    Versions
    • 1.10.4-2ubuntu1~16.04.1
    • 1.10.4-2ubuntu1~16.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.6 Ubuntu:16.04:LTS

    Versions
    • 1.6-0ubuntu1
    • 1.6-0ubuntu2
    • 1.6-0ubuntu3
    • 1.6-0ubuntu4
    • 1.6-0ubuntu5
    • 1.6.1-0ubuntu1
    • 1.6.2-0ubuntu5~16.04
    • 1.6.2-0ubuntu5~16.04.2
    • 1.6.2-0ubuntu5~16.04.3
    • 1.6.2-0ubuntu5~16.04.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.10 Ubuntu:18.04:LTS

    Versions
    • 1.10~rc1-1
    • 1.10~rc1-1ubuntu1
    • 1.10~rc1-2ubuntu1
    • 1.10~rc2-1ubuntu1
    • 1.10-1ubuntu1
    • 1.10.1-1ubuntu2
    • 1.10.4-2ubuntu1~18.04.1
    • 1.10.4-2ubuntu1~18.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.8 Ubuntu:18.04:LTS

    Versions
    • 1.8.3-2ubuntu1
    • 1.8.3-2ubuntu1.18.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.9 Ubuntu:18.04:LTS

    Versions
    • 1.9.1-2ubuntu1
    • 1.9.2-1ubuntu1
    • 1.9.2-3ubuntu1
    • 1.9.3-1ubuntu1
    • 1.9.4-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →