crypto/x509: CPU denial of service in chain validation
dmitshur opened this issue · 7 comments
Package crypto/x509 parses and validates X.509-encoded keys and certificates. It's supposed to handle certificate chains provided by an attacker with reasonable resource use.
The crypto/x509 package does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients verifying certificates are affected.
Thanks to Netflix for discovering and reporting this issue.
This issue is CVE-2018-16875.
Change https://golang.org/cl/154105 mentions this issue: crypto/x509: limit number of signature checks for each verification
I am experiencing failure in tls.RequireAndVerifyClientCert with otherwise previously valid combination of CA - Client Certificate.
The TLS server, compiled with go1.11.2 happily accepts the client certificate validated against the CA.
However the TLS server, compiled with go1.11.3, raises a tls: failed to verify client's certificate: x509: certificate signed by unknown authority.
Are there known incompatibilities caused by this patch when evaluating CAs for inclusion incertPool.AppendCertsFromPEM or verified with a tls.Config using ClientAuth: tls.RequireAndVerifyClientCert ?
The issue appeared to be linked to changes in func (s *CertPool) findPotentialParents(cert *Certificate) []int.
My certificate has an AuthorityKeyId, however the certificate pool only has the byName map filled.
The previous logic reverted to finding candidates by name if none were found by AuthorityKeyId, the new code does not.
/cc @FiloSottile Can you tell if the above is a problem with the fix? If you need more information, let's ask @abarisani to make a new issue report, and reference this closed issue in it.
Change https://golang.org/cl/161097 mentions this issue: crypto/x509: consider parents by Subject if AKID has no match
Change https://golang.org/cl/163739 mentions this issue: [release-branch.go1.11] crypto/x509: consider parents by Subject if AKID has no match