crypto/dsa: invalid public key causes panic in dsa.Verify

[katiehockman]

Invalid DSA public keys can cause a panic in dsa.Verify. In particular, using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don’t chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server that accepts and verifies client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected.

Moreover, an application might crash invoking crypto/x509.(*CertificateRequest) CheckSignature on an X.509 certificate request, parsing a golang.org/x/crypto/openpgp Entity, or during a golang.org/x/crypto/otr conversation. Finally, a golang.org/x/crypto/ssh client can panic due to a malformed host key, while a server could panic if either PublicKeyCallback accepts a malformed public key, or if IsUserAuthority accepts a certificate with a malformed public key.

The issue is CVE-2019-17596.

[katiehockman]

@gopherbot please open backport issues as this is a security issue

[gopherbot]

Backport issue(s) opened: #34961 (for 1.12), #34962 (for 1.13).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://golang.org/wiki/MinorReleases.

[kevinburke1]

I may be missing something, but I don't see this commit on or near tip of the master branch. Is Go 1.14/master not vulnerable to this issue?

[FiloSottile]

The announcement has more details about the impact: https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ

@kevinburkemeter We do the cherry-pick to master last, as we make no security promises about tip, making it low priority. This issue will be closed when that happens.

[kevinburke1]

Ah, okay, thanks for the clarification. I got confused by the bot which says "as soon as the patch is submitted to master" which would seem to imply that's the first thing that happens.

[gopherbot]

Change https://golang.org/cl/205441 mentions this issue: crypto/dsa: prevent bad public keys from causing panic