Title4

[arisazimli]

Due Date: ****

A medium severity vulnerability has been discovered in your project.

Project Name: acunetixapi

Scanner Name: trivy

Cwe ID: 1035

Cwe Name: Using Components with Known Vulnerabilities

Cwe Link: https://cwe.mitre.org/data/definitions/1035.html

CVE ID: CVE-2024-24783

Target: usr/local/bin/gosu

Packages:

• : 1.18.2 - Fixed Version: 1.21.8, 1.22.1

References:

• http://www.openwall.com/lists/oss-security/2024/03/08/4
• https://access.redhat.com/errata/RHSA-2024:2724
• https://access.redhat.com/security/cve/CVE-2024-24783
• https://bugzilla.redhat.com/2268017
• https://bugzilla.redhat.com/2268018
• https://bugzilla.redhat.com/2268019
• https://bugzilla.redhat.com/2268273
• https://bugzilla.redhat.com/show_bug.cgi?id=2268017
• https://bugzilla.redhat.com/show_bug.cgi?id=2268018
• https://bugzilla.redhat.com/show_bug.cgi?id=2268019
• https://bugzilla.redhat.com/show_bug.cgi?id=2268273
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45288
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45289
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45290
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24783
• https://errata.almalinux.org/9/ALSA-2024-2724.html
• https://errata.rockylinux.org/RLSA-2024:2724
• GHSA-3q2c-pvp5-3cqp
• golang/go@337b8e9 (go1.22.1)
• golang/go@be5b52b (go1.21.8)
• crypto/x509: Verify panics on certificates with an unknown public key algorithm [CVE-2024-24783] golang/go#65390
• https://go.dev/cl/569339
• https://go.dev/issue/65390
• https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• https://linux.oracle.com/cve/CVE-2024-24783.html
• https://linux.oracle.com/errata/ELSA-2024-5258.html
• https://nvd.nist.gov/vuln/detail/CVE-2024-24783
• https://pkg.go.dev/vuln/GO-2024-2598
• https://security.netapp.com/advisory/ntap-20240329-0005
• https://security.netapp.com/advisory/ntap-20240329-0005/
• https://ubuntu.com/security/notices/USN-6886-1
• https://www.cve.org/CVERecord?id=CVE-2024-24783

Tool Description: Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

Custom Description: test after refactoring

Kondukto Link: http://localhost/projects/66c335db7de81b375832111f/vulns/appsec?page=1&perPage=15&id=in:66c5a4c19cdb9b6596274186
Deeplink: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24783