GO TLS握手 崩溃漏洞 CVE-2021-34558

漏洞描述

There is a minor modification to ./vendor/github.com/refraction-networking/utls/handshake_server.go to enable the malicious handshake to be sent with a mismatching certificate/cipher.

漏洞影响

Go Version < (1.16.6+)

漏洞复现

<img src="https://typora-notes-1308934770.cos.ap-beijing.myqcloud.com/202205201317475.png" alt="image-20220520131711402" style="zoom:67%;" />

将会生成 https 服务,此时当版本较低时就会产生崩溃,例如部分扫描器对目标进行扫描时

image-20220520131729852

image-20220520131729852