Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto/x509: ParsePKCS1PrivateKey panic with partial keys [CVE-2025-22865] #71216

Closed
rolandshoemaker opened this issue Jan 10, 2025 · 3 comments
Closed

crypto/x509: ParsePKCS1PrivateKey panic with partial keys [CVE-2025-22865] #71216

rolandshoemaker opened this issue Jan 10, 2025 · 3 comments
Labels
NeedsFix The path to resolution is known, but the work has not been done. Security
Milestone
Go1.24

Comments

@rolandshoemaker
Copy link
Member

rolandshoemaker commented Jan 10, 2025 •
edited by mknyszek
Loading

Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic
when verifying that the key is well formed.

Thanks to Philippe Antoine (Catena cyber) for reporting this issue.

This is CVE-2025-22865.

Tracked in http://b/388805795 and fixed by https://go-internal-review.googlesource.com/c/go/+/1820.

/cc @golang/security and @golang/release
@rolandshoemaker rolandshoemaker added Security NeedsFix The path to resolution is known, but the work has not been done. labels Jan 10, 2025
@gabyhelp
Copy link

Related Issues

(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)

@gabyhelp gabyhelp added the BugReport Issues describing a possible bug in the Go implementation. label Jan 10, 2025
@rolandshoemaker rolandshoemaker removed the BugReport Issues describing a possible bug in the Go implementation. label Jan 15, 2025
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/643098 mentions this issue: crypto/x509: avoid panic when parsing partial PKCS#1 private keys

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/643102 mentions this issue: crypto/x509: avoid panic when parsing partial PKCS#1 private keys

gopherbot pushed a commit that referenced this issue Jan 16, 2025
@FiloSottile @gopherbot
[release-branch.go1.24] crypto/x509: avoid panic when parsing partial…
3de5aca 
… PKCS#1 private keys

These keys are off-spec, but have historically been accepted by
ParsePKCS1PrivateKey.

Thanks to Philippe Antoine (Catena cyber) for reporting this issue.

Fixes #71216
Fixes CVE-2025-22865

Change-Id: I6a6a46564156fa32e29e8d6acbec3fbac47c7352
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1820
Reviewed-by: Tatiana Bradley <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
Commit-Queue: Roland Shoemaker <[email protected]>
(cherry picked from commit 36c6c8b6957e155770461fd710aea9477ef3bc88)
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1841
Reviewed-on: https://go-review.googlesource.com/c/go/+/643102
Auto-Submit: Michael Knyszek <[email protected]>
Reviewed-by: Michael Pratt <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
@mknyszek mknyszek changed the title security: fix CVE-2025-22865 crypto/x509: ParsePKCS1PrivateKey panic with partial keys [CVE-2025-22865] Jan 16, 2025
@dmitshur dmitshur added this to the Go1.24 milestone Jan 16, 2025
wyf9661 pushed a commit to wyf9661/go that referenced this issue Jan 21, 2025
@FiloSottile @wyf9661
[release-branch.go1.24] crypto/x509: avoid panic when parsing partial…
afbd138 
… PKCS#1 private keys

These keys are off-spec, but have historically been accepted by
ParsePKCS1PrivateKey.

Thanks to Philippe Antoine (Catena cyber) for reporting this issue.

Fixes golang#71216
Fixes CVE-2025-22865

Change-Id: I6a6a46564156fa32e29e8d6acbec3fbac47c7352
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1820
Reviewed-by: Tatiana Bradley <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
Commit-Queue: Roland Shoemaker <[email protected]>
(cherry picked from commit 36c6c8b6957e155770461fd710aea9477ef3bc88)
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1841
Reviewed-on: https://go-review.googlesource.com/c/go/+/643102
Auto-Submit: Michael Knyszek <[email protected]>
Reviewed-by: Michael Pratt <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
NeedsFix The path to resolution is known, but the work has not been done. Security
Projects
None yet
Milestone
Go1.24
Development

No branches or pull requests
4 participants
@dmitshur @rolandshoemaker @gopherbot @gabyhelp