| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/arslanbekov/terraform-provider-sendgrid | ≤ 1.1.3-0.20250606002314-b4a2dfeb7b0f |
A critical vulnerability has been identified at https://security.snyk.io/package/linux/chainguard:latest/terraform-provider-sendgrid, associated with the underlying Go version.
If the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via Config.Clone() combined with modification or GetConfigForClient — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list.
As a result, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session.
If the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via Config.Clone() combined with modification or GetConfigForClient — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list.
Consequently, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free