CVE-2017-1000097 Mishandled trust preferences for root certificates on Darwin in crypto/x509
HighCVSS 7.5
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| stdlib(Go) | < 1.6.4 | 1.6.4 |
| stdlib(Go) | >= 1.7.0-0, < 1.7.4 | 1.7.4 |
| golang go | < 1.6.4 | 1.6.4 |
| golang go | >= 1.7, < 1.7.4 | 1.7.4 |
References
- go.googlesource.com patch
- go.dev issue-tracking
- groups.google.com
- github.com issue-tracking third-party-advisory
- go-review.googlesource.com broken-link
- groups.google.com