CVE-2014-7189 Man-in-the-middle attack with SessionTicketsDisabled in crypto/tls
MediumCVSS 4.3
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| stdlib(Go) | >= 1.1.0-0, < 1.3.2 | 1.3.2 |
| golang go | = 1.1 | No fix listed |
| golang go | = 1.1.1 | No fix listed |
| golang go | = 1.1.2 | No fix listed |
| golang go | = 1.2 | No fix listed |
| golang go | = 1.2.1 | No fix listed |
| golang go | = 1.2.2 | No fix listed |
| golang go | = 1.3 | No fix listed |
| golang go | = 1.3.1 | No fix listed |
References
- go.dev patch
- go.dev issue-tracking
- groups.google.com
- [oss-security] 20140926 Re: CVE Request: Go crypto/tls vulnerability mailing-list
- 70156 vdb-entry
- go-cve20147189-sec-bypass(96693) vdb-entry
- groups.google.com