CVE-2020-7919

Vulnerability

Overview

CVE-2020-7919 is a denial-of-service vulnerability in Go's crypto/x509 certificate parsing and the ASN.1 parsing functions of golang.org/x/crypto/cryptobyte. On 32-bit architectures, a malformed input can lead to a panic [3]. The root cause is improper handling of crafted certificate data in the ASN.1 parsing routines.

Exploitation

Vector

A malformed X.509 certificate can be delivered via a crypto/tls connection to a client, or to a server that accepts client certificates [3]. For example, net/http clients can be made to crash by an HTTPS server. However, net/http servers that accept client certificates recover from the panic and are unaffected [3]. The vulnerability is triggered when the client processes a crafted certificate during the TLS handshake.

Impact

An attacker who can serve a malformed certificate to a Go-based TLS client (or to a server that accepts client certificates) can cause the target application to panic and crash, resulting in a denial of service [3]. This is a high-severity issue (CVSS 7.5) because it requires no special privileges and can be triggered remotely. The vulnerability does not enable code execution or privilege escalation.

Mitigation

The issue is fixed in Go 1.12.16 and Go 1.13.7, as well as in the cryptobyte package version v0.0.0-20200124225646-8b5121be2f68 [3][4]. Users should upgrade to these versions or later. The fix is also included in Go 1.14rc1 [3]. There is no workaround other than updating, as the vulnerability affects the TLS stack itself.