Go ExtKeyUsageAny Policy Validation Bypass Vulnerability

A vulnerability in the Go programming language's standard library, specifically in the crypto/x509 package, has been identified. This issue arises when the Verify function is called with VerifyOptions.KeyUsages that include ExtKeyUsageAny, which unintentionally disables policy validation. The vulnerability affects certificate chains containing policy graphs, a rare occurrence.

Impact

Exploitation of this vulnerability leads to the unintentional bypass of policy validation in certificate verification, which could allow for the acceptance of certificates that should be rejected based on policy rules.

Remediation

Users can upgrade to Go versions 1.24.4 or 1.23.10, both of which include the necessary fix. Instructions for downloading these versions are available on the Go website.