GO-2021-0223

vendorUSosv

Certificate verification error on Windows in crypto/x509

view advisory published 2022-02-17Licence: per source

On Windows, if VerifyOptions.Roots is nil, Certificate.Verify does not check the EKU requirements specified in VerifyOptions.KeyUsages. This may allow a certificate to be used for an unintended purpose.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-14039US	medium5.3	1.76% (78th)	—	2020-07-17
In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the instal…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/242597FIX
https://go.dev/issue/39360REPORT
https://go.googlesource.com/go/+/82175e699a2e2cd83d3aa34949e9b922d66d52f5FIX
https://groups.google.com/g/golang-announce/c/XZNfaiwgt2wWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan