Description
On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate.
References (3)
Core 3
Core References
Mailing List x_refsource_confirm
https://groups.google.com/forum/#%21msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ
Broken Link x_refsource_confirm
https://go-review.googlesource.com/c/33721/
Issue Tracking, Third Party Advisory x_refsource_confirm
https://github.com/golang/go/issues/18141
Scores
CVSS v3
7.5
EPSS
0.0018
EPSS Percentile
38.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-295
Status
published
Products (1)
golang/go
< 1.6.4
Published
Oct 05, 2017
Tracked Since
Feb 18, 2026