Vulnerability Report: GO-2022-0171
- CVE-2017-1000097
- Affects: crypto/x509
- Published: May 24, 2022
- Modified: Jun 12, 2023
On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate.
Affected Packages
-
PathVersionsSymbols
-
before go1.6.4, from go1.7.0-0 before go1.7.4
Aliases
References
- https://go.dev/cl/33721
- https://go.googlesource.com/go/+/7e5b2e0ec144d5f5b2923a7d5db0b9143f79a35a
- https://go.dev/issue/18141
- https://groups.google.com/g/golang-dev/c/4NdLzS8sls8/m/uIz8QlnIBQAJ
- https://vuln.go.dev/ID/GO-2022-0171.json
Credits
- Xy Ziemba
Feedback
See anything missing or incorrect?
Suggest an edit to this report.