CVE-2024-24783

Description

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Trends

Current EPSS score: 0.67%• Percentile: 50%

Techniques & Countermeasures

• CWE-476•NULL Pointer Dereference

  The product dereferences a pointer that it expects to be valid but is NULL.

Affected Systems

• chainguard•actions-runner-controller

  < 0.8.3-r1

• chainguard•amass

  < 4.2.0-r4

• chainguard•argo-workflows

  < 3.6.5-r2

• chainguard•argo-workflows-fips

  < 3.5.5-r1

• chainguard•atlantis-fips

  < 0.33.0-r6

• chainguard•aws-ebs-csi-driver

  < 1.28.0-r1

• chainguard•aws-efs-csi-driver

  < 1.7.6-r1

• chainguard•aws-efs-csi-driver-fips

  < 1.7.0-r4

• chainguard•aws-flb-cloudwatch

  < 1.9.4-r7

• chainguard•aws-flb-firehose

  < 1.7.2-r7

• chainguard•aws-flb-kinesis

  < 1.10.2-r7

• chainguard•aws-load-balancer-controller

  < 2.7.1-r1

• chainguard•aws-load-balancer-controller-fips

  < 2.7.1-r1

• chainguard•azure-aad-pod-identity-mic

  < 1.8.17-r5

• chainguard•bank-vaults-fips

  < 1.20.4-r5

• chainguard•bazelisk

  < 1.19.0-r1

• chainguard•bom

  < 0.6.0-r1

• chainguard•boring-registry-fips

  < 0.13.2-r1

• chainguard•buildkitd

  < 0.13.1-r2

• chainguard•caddy

  < 2.7.6-r3

• chainguard•cadvisor

  < 0.49.1-r3

• chainguard•cadvisor-compat

  < 0.49.1-r3

• chainguard•capslock

  < 0.2.1-r1

• chainguard•cass-operator

  < 1.18.2-r4

• chainguard•cass-operator-fips

  < 1.18.2-r3

• chainguard•cass-operator-fips-no-pvc-delete

  < 1.18.2-r4

• chainguard•cert-exporter

  < 2.12.0-r1

• chainguard•cert-exporter-fips

  < 2.12.0-r1

• chainguard•cfssl

  < 1.6.5-r0

• chainguard•chainctl

  < 0.2.59-r0

• chainguard•chartmuseum

  < 0.16.1-r4

• chainguard•cloud-sql-proxy-fips

  < 2.8.2-r1

• chainguard•cluster-autoscaler-1.27

  < 1.27.5-r2

• chainguard•cluster-autoscaler-1.27-compat

  < 1.27.5-r2

• chainguard•cluster-autoscaler-1.28

  < 1.28.2-r2

• chainguard•cluster-autoscaler-1.28-compat

  < 1.28.2-r2

• chainguard•cluster-proportional-autoscaler

  < 1.8.11-r1

• chainguard•cni-plugins

  < 1.4.0-r2

• chainguard•cni-plugins-fips

  < 1.4.0-r2

• chainguard•configmap-reload

  < 0.12.0-r4

• chainguard•configmap-reload-fips

  < 0.12.0-r3

• chainguard•configmap-reload-fips-0.11

  < 0.11.1-r4

• chainguard•controller-gen

  < 0.14.0-r1

• chainguard•cortex

  < 1.16.0-r2

• chainguard•cri-tools

  < 1.29.0-r4

• chainguard•crossplane-provider-azure

  < 0.42.1-r1

• chainguard•ctop

  < 0.7.7-r11

• chainguard•cue

  < 0.7.1-r1

• chainguard•cue-fips

  < 0.7.1-r1

• chainguard•dagger

  < 0.10.1-r1

Showing first 50 affected entries in server-rendered view.

References (25)

• https://go.dev/issue/65390
• https://go.dev/cl/569339
• https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• https://pkg.go.dev/vuln/GO-2024-2598
• https://security.netapp.com/advisory/ntap-20240329-0005/
• http://www.openwall.com/lists/oss-security/2024/03/08/4
• https://access.redhat.com/errata/RHSA-2024:6186
• https://access.redhat.com/security/updates/classification/#moderate
• https://bugzilla.redhat.com/show_bug.cgi?id=2268019
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6186.json
• https://access.redhat.com/security/cve/CVE-2024-24783
• https://www.cve.org/CVERecord?id=CVE-2024-24783
• https://nvd.nist.gov/vuln/detail/CVE-2024-24783
• https://github.com/advisories/GHSA-3q2c-pvp5-3cqp
• https://security.netapp.com/advisory/ntap-20240329-0005
• https://access.redhat.com/errata/RHSA-2024:6187
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6187.json
• https://access.redhat.com/errata/RHSA-2024:6188
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6188.json
• https://access.redhat.com/errata/RHSA-2024:6189
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6189.json
• https://access.redhat.com/errata/RHSA-2024:6195
• https://issues.redhat.com/browse/RHEL-40805
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6195.json
• https://security-tracker.debian.org/tracker/CVE-2024-24783