Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2018-16875

Good to know:

icon

Date: December 14, 2018

The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.

Language: RUST

Severity Score

Related Resources (22)

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html
https://nvd.nist.gov/vuln/detail/CVE-2018-16875
https://access.redhat.com/security/cve/CVE-2018-16875
https://go.dev/cl/154105
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16875
https://go.googlesource.com/go/+/770130659b6fb2acf271476579a3644e093dda7f
https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html
https://security.gentoo.org/glsa/201812-09
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html
https://rustsec.org/advisories/RUSTSEC-2023-0052.html
http://www.securityfocus.com/bid/106230
https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16875
https://crates.io/crates/webpki
https://groups.google.com/g/golang-announce/c/Kw31K8G7Fi0
https://go.dev/issue/29233
https://rustsec.org/advisories/RUSTSEC-2023-0053.html
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html
https://crates.io/crates/rustls-webpki
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html
https://www.mend.io/resources/blog/top-5-go-vulnerabilities
https://www.mend.io/vulnerability-database/CVE-2018-16875

Severity Score

Weakness Type (CWE)

Improper Certificate Validation

CWE-295

Input Validation

CWE-20

Top Fix

icon

Upgrade Version

Upgrade to version golang 1.10.6,golang 1.11.3, webpki - 0.22.2, rustls-webpki - 0.100.2,0.101.4

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): COMPLETE
Additional information:

Do you need more information?

Contact Us