In short
- CVE-2017-15042 is a MEDIUM (CVSS 5.9) vulnerability affecting stdlib, go (golang).
- Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.1% of all vulnerabilities.
- Fix: update to 1.8.4, 1.9.1 or later.
| Package | Affected versions | Patched versions |
|---|
| stdlib Go | ≥ 1.1.0-0, < 1.8.4≥ 1.9.0-0, < 1.9.1
| 1.8.41.9.1
|
| go | = 1.9≤ 1.8.3
| No fix yet |
Description
SMTP clients using net/smtp can use the PLAIN authentication scheme on network connections not secured with TLS, exposing passwords to man-in-the-middle SMTP servers.
NVD description
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free