Hybrid Group Gobot Improper Certificate Validation vulnerability

HOCH 7.5CVE-2019-12496 · GHSA-vfxc-r2gx-v2vq · GO-2021-0083 · Published 31/05/2019 · updated 17/06/2026

Kurz gesagt

CVE-2019-12496 ist eine Schwachstelle (HOCH (CVSS 7.5)) in github.com/hybridgroup/gobot, gobot (hybridgroup).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.71%, höher als bei 53.8% aller Schwachstellen.
Abhilfe: auf 1.12.1-0.20190521122906-c1aa4f867846, 1.13.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
github.com/hybridgroup/gobot Go	`< 1.12.1-0.20190521122906-c1aa4f867846`	`1.12.1-0.20190521122906-c1aa4f867846`
gobot hybridgroup	`< 1.13.0`	`1.13.0`

An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default.

github.com/hybridgroup/gobot/platforms/mqtt

NVD description

An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.