HIGH7.5

GO-2022-0166

Denial of service due to unchecked parameters in crypto/dsa

Quick fix

GO-2022-0166 — stdlib: upgrade to the fixed version with the command below.

go get stdlib@v1.5.4

Details

The Verify function in crypto/dsa passed certain parameters unchecked to the underlying big integer library, possibly leading to extremely long-running computations, which in turn makes Go programs vulnerable to remote denial of service attacks. Programs using HTTPS client certificates or the Go SSH server libraries are both exposed to this vulnerability.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/stdlib

Introduced in: 0Fixed in: 1.5.4

Fixgo get stdlib@v1.5.4

References

https://go.dev/cl/21533[FIX]
https://go.googlesource.com/go/+/eb876dd83cb8413335d64e50aae5d38337d1ebb4[FIX]
https://go.dev/issue/15184[REPORT]
https://groups.google.com/g/golang-announce/c/9eqIHqaWvck[WEB]