Google Go up to 1.22.10/1.23.4 crypto-x509 crypto/x509 certificate validation

Summaryinfo

A vulnerability was found in Google Go up to 1.22.10/1.23.4 and classified as critical. This affects an unknown function of the file crypto/x509 of the component crypto-x509. Such manipulation leads to certificate validation. This vulnerability is referenced as CVE-2024-45341. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Google Go up to 1.22.10/1.23.4. Affected by this issue is an unknown code of the file crypto/x509 of the component crypto-x509. The manipulation with an unknown input leads to a certificate validation vulnerability. Using CWE to declare the problem leads to CWE-295. The product does not validate, or incorrectly validates, a certificate. Impacted is integrity. CVE summarizes:

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.

The weakness was published by Juho Forsén. The advisory is shared for download at seclists.org. This vulnerability is handled as CVE-2024-45341. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1587.003.

The vulnerability scanner Nessus provides a plugin with the ID 214540 (Golang 1.24 < 1.24rc2 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.22.11 or 1.23.5 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (214540) and CERT Bund (WID-SEC-2025-0111). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Xerox FreeFlow Print Server
• Oracle Linux
• SUSE openSUSE
• IBM App Connect Enterprise
• Golang Go
• IBM Business Automation Workflow

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Go

Version

• 1.22.0
• 1.22.1
• 1.22.2
• 1.22.3
• 1.22.4
• 1.22.5
• 1.22.6
• 1.22.7
• 1.22.8
• 1.22.9
• 1.22.10
• 1.23.0
• 1.23.1
• 1.23.2
• 1.23.3
• 1.23.4

License

• open-source

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion