Skip to content

crypto/x509: certificate validation bypass on Windows 10 #36834

Closed
Closed
crypto/x509: certificate validation bypass on Windows 10#36834
Labels
FrozenDueToAgeSecurity
Milestone
Go1.14

Description

@katiehockman
katiehockman
opened on Jan 28, 2020

A Windows vulnerability allows attackers to spoof valid certificate chains when the system root store is in use. This issue is tracking a mitigation for Go applications, but it’s strongly recommended that affected users install the Windows security update to protect their system.

This issue is CVE-2020-0601.

Activity

  1. katiehockman
    added
    Security
    on Jan 28, 2020
  2. katiehockman
    added this to the Go1.14 milestone on Jan 28, 2020
  3. katiehockman
    closed this as completedon Jan 28, 2020

  4. dmitshur commented on Jan 28, 2020

    @dmitshur
    dmitshur
    on Jan 28, 2020
    Member

    Fixed in master (which will become Go 1.14) in commit 953bc8f.

  5. golang
    locked and limited conversation to collaborators on Jan 27, 2021
  6. gopherbot
    added
    FrozenDueToAge
    on Jan 27, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    FrozenDueToAgeSecurity

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions