title: Verify panics on certificates with an unknown public key algorithm in crypto/x509
description: Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.
problem types: CWE-476: NULL Pointer Dereference
affected:
{
vendor: Go standard library
product: crypto/x509
collectionURL: https://pkg.go.dev
packageName: crypto/x509
versions:
version: 0, lessThan: 1.21.8, status: affected, versionType: semver
version: 1.22.0-0, lessThan: 1.22.1, status: affected, versionType: semver
programRoutines:
name: Certificate.buildChains
name: Certificate.Verify
defaultStatus: unaffected
}