« Volver al listado

CVE-2024-24783

Estado: AplazadaMedia (5.9)—

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Golang — Crypto/tlsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-24783",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-24783",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-03-06T18:26:26.163411Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@golang.org",
      "affectedData": [
        {
          "vendor": "Go standard library",
          "product": "crypto/x509",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.21.8",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.22.0-0",
              "lessThan": "1.22.1",
              "versionType": "semver"
            }
          ],
          "packageName": "crypto/x509",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "Certificate.buildChains"
            },
            {
              "name": "Certificate.Verify"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-03-05T23:15:07.683",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4",
      "source": "security@golang.org"
    },
    {
      "url": "https://go.dev/cl/569339",
      "source": "security@golang.org"
    },
    {
      "url": "https://go.dev/issue/65390",
      "source": "security@golang.org"
    },
    {
      "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg",
      "source": "security@golang.org"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2024-2598",
      "source": "security@golang.org"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20240329-0005/",
      "source": "security@golang.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://go.dev/cl/569339",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://go.dev/issue/65390",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2024-2598",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20240329-0005/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates."
    },
    {
      "lang": "es",
      "value": "La verificación de una cadena de certificados que contiene un certificado con un algoritmo de clave pública desconocido provocará que Certificate.Verify entre en pánico. Esto afecta a todos los clientes cripto/tls y a los servidores que configuran Config.ClientAuth en VerifyClientCertIfGiven o RequireAndVerifyClientCert. El comportamiento predeterminado es que los servidores TLS no verifiquen los certificados de los clientes."
    }
  ],
  "lastModified": "2026-06-17T07:14:51.060",
  "sourceIdentifier": "security@golang.org"
}