AZL-37320

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-37320.json

JSON Data

https://api.test.osv.dev/v1/vulns/AZL-37320

Upstream

CVE-2024-24783

Published

2024-03-05T23:15:07Z

Modified

2026-04-01T05:13:13.722482Z

Summary

CVE-2024-24783 affecting package golang for versions less than 1.21.6-1

Details

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-24783

Affected packages

Azure Linux:2 / golang

Package

Name: golang
Purl: pkg:rpm/azure-linux/golang

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.18.0

Fixed

1.21.6-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-37320.json"