Description
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 10 | golang-1.11 | 1.11.6-1+deb10u4 | DSA-4848-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | golang-1.14 | 1.14~rc1-1 | — |
| Ubuntu 18.04 LTS | golang-1.10 | No fix yet | — |
| Ubuntu 16.04 LTS | golang-1.10 | No fix yet | — |
| Ubuntu 14.04 LTS | golang-1.10 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | golang-1.13 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | golang-1.13 | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | containerd | 1.3.3-r0 | — |
| Alpine v3.24 | go | 1.13.7-r0 | — |
| Alpine v3.23 | containerd | 1.3.3-r0 | — |
| Alpine v3.23 | go | 1.13.7-r0 | — |
| Alpine v3.22 | containerd | 1.3.3-r0 | — |
| Alpine v3.22 | go | 1.13.7-r0 | — |
| Alpine v3.21 | containerd | 1.3.3-r0 | — |
| Alpine v3.21 | go | 1.13.7-r0 | — |
| Alpine v3.20 | containerd | 1.3.3-r0 | — |
| Alpine v3.20 | go | 1.13.7-r0 | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | containerd | 1.3.3-r0 | — |
| Alpine v3.19 | go | 1.13.7-r0 | — |
| Alpine v3.18 | containerd | 1.3.3-r0 | — |
| Alpine v3.18 | go | 1.13.7-r0 | — |
| Alpine v3.17 | containerd | 1.3.3-r0 | — |
| Alpine v3.17 | go | 1.13.7-r0 | — |
| Alpine v3.16 | containerd | 1.3.3-r0 | — |
| Alpine v3.16 | go | 1.13.7-r0 | — |
| Alpine v3.15 | containerd | 1.3.3-r0 | — |
| Alpine v3.15 | go | 1.13.7-r0 | — |
| Alpine v3.14 | containerd | 1.3.3-r0 | — |
| Alpine v3.14 | go | 1.13.7-r0 | — |
| Alpine v3.13 | containerd | 1.3.3-r0 | — |
| Alpine v3.13 | go | 1.13.7-r0 | — |
| Alpine v3.12 | containerd | 1.3.3-r0 | — |
| Alpine v3.12 | go | 1.13.7-r0 | — |
| Alpine v3.11 | containerd | 1.3.3-r0 | — |
| Alpine v3.11 | go | 1.13.7-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | k3d +2 | 5.6.0-r11 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/helm/helm | >= 2.0.0, < 2.16.8 | 2.16.8 | GHSA-cjjc-xp8v-855w |
| Go | golang.org/x/crypto | < 0.0.0-20200124225646-8b5121be2f68 | 0.0.0-20200124225646-8b5121be2f68 | GHSA-cjjc-xp8v-855w |
| Go | helm.sh/helm/v3 | >= 3.0.0, < 3.1.0 | 3.1.0 | GHSA-cjjc-xp8v-855w |
| Go | stdlib | < 1.12.16 · >= 1.13.0-0, < 1.13.7 | 1.12.16, 1.13.7 | GO-2022-0229 |
Advisories 2
- WID-SEC-2022-0510 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2026
- DSA-4848-1 golang-1.11 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- FEDORA-2020-12bc5b5597 vendor-advisory
- https://groups.google.com/forum/#%21forum/golang-announce
- DSA-4848 vendor-advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://groups.google.com/forum/#%21topic/golang-announce/-sdUB4VEQkA
- https://groups.google.com/forum/#%21topic/golang-announce/Hsw4mHYc470
- https://security.netapp.com/advisory/ntap-20200327-0001/