GO-2022-0535
Certificate validation bypass on Windows in crypto/x509
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2020-0601
- Alias
- BIT-golang-2020-0601
Description
A Windows vulnerability allows attackers to spoof valid certificate chains when the system root store is in use. A workaround is present in Go 1.12.6+ and Go 1.13.7+, but affected users should additionally install the Windows security update to protect their system. See https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-0601 for details on the Windows vulnerability.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.12.16, introduced 1.13.0-0, fixed 1.13.7 |
Références
- https://go.dev/cl/215905 FIX
- https://go.googlesource.com/go/+/953bc8f391a63adf00bac2515dba62abe8a1e2c2 FIX
- https://go.dev/issue/36834 REPORT
- https://groups.google.com/g/golang-announce/c/Hsw4mHYc470/m/WJeW5wguEgAJ WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |