In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Sep 14, 2022 | Jul 17, 2020 |
| Suse | — | Upgrade terraform-provider-helmUpgrade terraform-provider-azurermUpgrade terraform-provider-tlsUpgrade terraform-provider-nullUpgrade terraform-provider-kubernetesUpgrade go1.14-raceUpgrade go1.13-docUpgrade terraform-provider-localUpgrade go1.14-docUpgrade terraform-provider-randomUpgrade terraform-provider-externalUpgrade go1.13-raceUpgrade go1.13Upgrade go1.14Upgrade terraform-provider-googleUpgrade terraformUpgrade terraform-provider-aws | Jul 27, 2020 | Jul 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub