MEDIUM5.9

GO-2024-2598

Verify panics on certificates with an unknown public key algorithm in crypto/x509

Quick fix

GO-2024-2598 — stdlib: upgrade to the fixed version with the command below.

go get stdlib@v1.21.8

Details

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic.

This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/stdlib

Introduced in: 0Fixed in: 1.21.8

Fixgo get stdlib@v1.21.8

References

https://go.dev/issue/65390[REPORT]
https://go.dev/cl/569339[FIX]
https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg[WEB]