GO-2022-0535 Certificate validation bypass on Windows in crypto/x509

🗓️ 01 Aug 2022 22:21:17Reported by GoogleType

osv🔗 osv.dev👁 42 Views

Certificate validation bypass on Windows in crypto/x509. Window vulnerability allows attackers to spoof valid certificate chains. Workaround in Go 1.12.6+ and Go 1.13.7+. Users should install Windows security update

Reporter	Title	Published	Views	Family All 107
GithubExploit	Exploit for Improper Certificate Validation in Microsoft	19 Jan 202018:20	–	githubexploit
GithubExploit	Exploit for Improper Certificate Validation in Microsoft	15 Jan 202023:07	–	githubexploit
GithubExploit	Exploit for Improper Certificate Validation in Microsoft	16 Jan 202002:46	–	githubexploit
GithubExploit	Exploit for Improper Certificate Validation in Microsoft	3 Feb 202013:58	–	githubexploit
GithubExploit	Exploit for Improper Certificate Validation in Microsoft	15 Jan 202000:01	–	githubexploit
GithubExploit	exploits	25 May 202601:12	–	githubexploit
GithubExploit	Exploit for Improper Certificate Validation in Microsoft	15 Jan 202023:07	–	githubexploit
GithubExploit	Exploit for Improper Certificate Validation in Microsoft	14 Jan 202023:53	–	githubexploit
GithubExploit	Exploit for Improper Certificate Validation in Microsoft	17 Jan 202111:53	–	githubexploit
0day.today	Microsoft Windows - CryptoAPI (Crypt32.dll) Elliptic Curve Cryptography (ECC) Spoof Code-Signing	16 Jan 202000:00	–	zdt

Source	Link
go	www.go.dev/cl/215905
go	www.go.googlesource.com/go/+/953bc8f391a63adf00bac2515dba62abe8a1e2c2
go	www.go.dev/issue/36834
groups	www.groups.google.com/g/golang-announce/c/Hsw4mHYc470/m/WJeW5wguEgAJ

20 May 2024 16:03Current

8High risk

Vulners AI Score8

CVSS 25.8

CVSS 3.18.1

EPSS0.89436

SSVC