The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expecte

Summary

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

Timeline

1. Jul 15, 2021, 1:47 PM UTCCVE published
2. Aug 4, 2024, 12:12 AM UTCRecord last updated

Affected versions

• n/a n/a

  Version range not reported

• stdlibGo

  fixed in 1.15.14; From 1.16.0-0 · fixed in 1.16.6

References 17