Improper input validation in Go programming language - CVE-2018-16875

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU16546

Improper input validation in Go programming language - CVE-2018-16875

Published: December 14, 2018


Vulnerability identifier: #VU16546
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-16875
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists on Go TLS servers accepting client certificates and TLS clients due to the crypto/x509 package does not limit the amount of work performed for each chain verification. A remote unauthenticated attacker can craft pathological inputs leading to a CPU denial of service.


Affected software

Go programming language
Arch Linux
Gentoo Linux
Amazon Linux AMI
Fedora
SUSE Linux Enterprise Module for Containers
Opensuse
SUSE Linux
openSUSE Leap
SUSE Package Hub for SUSE Linux Enterprise
runc
runc-debuginfo
containerd
golang
etcdctl
etcd
docker
docker-debuginfo
Storage Ceph

How to mitigate CVE-2018-16875

The vulnerability has been fixed in the version 1.10.6, 1.11.3.

Go programming language - addressed in versions 1.10.6, 1.11.3
runc - update to 1.0.0~rc93-16.8.1
runc-debuginfo - update to 1.0.0~rc93-16.8.1
containerd - update to 1.4.4-16.38.1
golang - addressed in versions 1.10.7-1.fc28, 1.11.4-1.el6, 1.11.4-1.el7, 1.11.4-1.fc29, 1.11-6.fc29
etcdctl - update to 3.5.12-150000.7.6.1
etcd - update to 3.5.12-150000.7.6.1
Storage Ceph - update to 7.1
docker - update to 20.10.6_ce-98.66.1
docker-debuginfo - update to 20.10.6_ce-98.66.1

External References

Related Security Bulletins