Go DSA Public Key Handling Panic Vulnerability

A panic vulnerability has been identified in the Go programming language's standard library, specifically in the 'crypto/x509' package. This issue arises when validating certificate chains that include DSA public keys. The vulnerability is caused by an interface cast that incorrectly assumes DSA keys implement the 'Equal' method. As a result, programs that validate arbitrary certificate chains can experience a panic, disrupting normal execution.

Impact

Exploitation of this vulnerability leads to a panic, causing the program to crash and interrupt its normal operation.

Remediation

This vulnerability has been addressed in Go versions 1.25.2 and 1.24.8. Users can download these updated versions from the Go website or compile from source using the GitHub release.