Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.
The product does not validate, or incorrectly validates, a certificate.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Go | Golang | 1.12 (including) | 1.12.6 (excluding) |
| Go | Golang | 1.13 (including) | 1.13.7 (excluding) |
| Golang | Ubuntu | trusty | * |
| Golang-1.10 | Ubuntu | bionic | * |
| Golang-1.10 | Ubuntu | disco | * |
| Golang-1.10 | Ubuntu | esm-infra/bionic | * |
| Golang-1.10 | Ubuntu | trusty | * |
| Golang-1.10 | Ubuntu | trusty/esm | * |
| Golang-1.10 | Ubuntu | xenial | * |
| Golang-1.11 | Ubuntu | trusty | * |
| Golang-1.12 | Ubuntu | disco | * |
| Golang-1.12 | Ubuntu | eoan | * |
| Golang-1.13 | Ubuntu | bionic | * |
| Golang-1.13 | Ubuntu | eoan | * |
| Golang-1.13 | Ubuntu | esm-apps/bionic | * |
| Golang-1.13 | Ubuntu | esm-apps/xenial | * |
| Golang-1.13 | Ubuntu | trusty | * |
| Golang-1.13 | Ubuntu | upstream | * |
| Golang-1.13 | Ubuntu | xenial | * |
| Golang-1.14 | Ubuntu | focal | * |
| Golang-1.14 | Ubuntu | groovy | * |
| Golang-1.14 | Ubuntu | hirsute | * |
| Golang-1.14 | Ubuntu | trusty | * |
| Golang-1.6 | Ubuntu | trusty | * |