CVE-2025-58188

Description

Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.36%• Percentile: 29%

Techniques & Countermeasures

• CWE-295•Improper Certificate Validation

  The product does not validate, or incorrectly validates, a certificate.

Affected Systems

• chainguard•age

  < 1.2.1-r8

• chainguard•age-fips

  < 1.2.1-r8

• chainguard•amass

  < 5.0.1-r1

• chainguard•amazon-k8s-cni-fips

  < 1.20.4-r2

• chainguard•amazon-k8s-cni-init-fips

  < 1.20.4-r2

• chainguard•amazon-k8s-cni-init-fips-compat

  < 1.20.4-r2

• chainguard•ansible-operator

  < 1.41.0-r1

• chainguard•ansible-operator-compat

  < 1.41.0-r1

• chainguard•apisix-ingress-controller

  < 1.8.4-r4

• chainguard•apisix-ingress-controller-compat

  < 1.8.4-r4

• chainguard•apisix-ingress-controller-iamguarded-compat

  < 1.8.4-r4

• chainguard•apm-server-7.17

  < 7.17.29-r4

• chainguard•apm-server-7.17-compat

  < 7.17.29-r4

• chainguard•apm-server-8.17

  < 8.17.10-r2

• chainguard•apm-server-8.17-compat

  < 8.17.10-r2

• chainguard•apm-server-8.18

  < 8.18.8-r1

• chainguard•apm-server-8.18-compat

  < 8.18.8-r1

• chainguard•apm-server-fips-7.17

  < 7.17.29-r4

• chainguard•apm-server-fips-7.17-compat

  < 7.17.29-r4

• chainguard•apm-server-fips-8.17

  < 8.17.10-r1

• chainguard•apm-server-fips-8.17-compat

  < 8.17.10-r1

• chainguard•apm-server-fips-8.18

  < 8.18.8-r1

• chainguard•apm-server-fips-8.18-compat

  < 8.18.8-r1

• chainguard•apm-server-fips-9.0

  < 9.0.8-r1

• chainguard•apm-server-fips-9.0-compat

  < 9.0.8-r1

• chainguard•argo-cd-2.13-compat

  < 2.13.9-r2

• chainguard•argo-rollouts

  < 1.8.3-r4

• chainguard•argo-rollouts-fips

  < 1.8.3-r5

• chainguard•atlantis

  < 0.36.0-r2

• chainguard•auditbeat-fips-8.17

  < 8.17.10-r2

• chainguard•auditbeat-fips-8.18

  < 8.18.8-r2

• chainguard•auditbeat-fips-9.0

  < 9.0.8-r2

• chainguard•authservice-fips

  < 1.1.1-r1

• chainguard•authservice-fips-compat

  < 1.1.1-r1

• chainguard•aws-iam-authenticator

  < 0.7.8-r1

• chainguard•aws-iam-authenticator-fips

  < 0.7.8-r1

• chainguard•aws-node-termination-handler

  < 1.25.2-r2

• chainguard•aws-node-termination-handler-compat

  < 1.25.2-r2

• chainguard•aws-node-termination-handler-fips

  < 1.25.2-r2

• chainguard•aws-node-termination-handler-fips-compat

  < 1.25.2-r2

• chainguard•aws-privateca-issuer-compat-fips

  < 1.7.0-r3

• chainguard•aws-privateca-issuer-fips

  < 1.7.0-r3

• chainguard•aws-s3-controller

  < 1.1.1-r1

• chainguard•aws-signer-notation-plugin

  < 1.0.2292-r3

• chainguard•aws-signer-notation-plugin-fips

  < 1.0.2292-r3

• chainguard•aws-sigv4-proxy

  < 1.10-r3

• chainguard•aws-sigv4-proxy-compat

  < 1.10-r3

• chainguard•aws-sigv4-proxy-fips

  < 1.10-r3

• chainguard•aws-sigv4-proxy-fips-compat

  < 1.10-r3

• chainguard•azure-aad-pod-identity-mic

  < 1.8.17-r28

Showing first 50 affected entries in server-rendered view.

References (9)

• https://go.dev/cl/709853
• https://go.dev/issue/75675
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
• https://pkg.go.dev/vuln/GO-2025-4013
• http://www.openwall.com/lists/oss-security/2025/10/08/1
• https://security-tracker.debian.org/tracker/CVE-2025-58188
• https://pkg.go.dev
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58188.json
• https://nvd.nist.gov/vuln/detail/CVE-2025-58188