Improper Certificate Validation in Go programming language - CVE-2022-27536

Vulnerability identifier: #VU65267

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-27536

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to certificate.Verify in crypto/x509 in Go can be caused to panic on macOS when presented with certain malformed certificates. A remote unauthenticated attacker can use a TLS server to cause a TLS client to panic.

Go programming language
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
Oracle Solaris
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
Development Tools Module
openSUSE Leap
Splunk Enterprise
Event Streams
Brownfield Connectivity - Gateway
go1.18
go1.18-doc
go1.18-race
go1.18-openssl
go1.18-openssl-doc
go1.18-openssl-race
IBM Cloud Pak for Multicloud Management Security Services
IBM Watson Discovery for IBM Cloud Pak for Data
Storage Ceph

Install updates from vendor's website.

Go programming language - update to 1.18.1
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
Event Streams - update to 11.0.2
Brownfield Connectivity - Gateway - update to 1.10.1
go1.18 - update to 1.18.1-150000.1.11.1
go1.18-doc - update to 1.18.1-150000.1.11.1
go1.18-race - update to 1.18.1-150000.1.11.1
go1.18-openssl - update to 1.18.10.1-150000.1.9.1
go1.18-openssl-doc - update to 1.18.10.1-150000.1.9.1
go1.18-openssl-race - update to 1.18.10.1-150000.1.9.1
IBM Cloud Pak for Multicloud Management Security Services - update to 2.3 Fix Pack 6
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.5.3
Storage Ceph - update to 7.1

• https://groups.google.com/g/golang-announce
• https://groups.google.com/g/golang-announce/c/oecdBNLOml8

• Multiple vulnerabilities in IBM Event Streams
• Gentoo update for Go
• Multiple vulnerabilities in Siemens Brownfield Connectivity Gateway
• SUSE update for go1.18
• Multiple vulnerabilities in Oracle Solaris
• SUSE update for go1.18-openssl
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Security Services
• Multiple vulnerabilities in IBM Storage Ceph
• Multiple vulnerabilities in IBM Watson Discovery