Microsoft Windows CryptoAPI Spoofing Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| stdlib | ≥ 1.13.0-0, < 1.13.7< 1.12.16 | 1.13.71.12.16 |
| go | ≥ 1.12, < 1.12.16≥ 1.13, < 1.13.7 | 1.12.161.13.7 |
A Windows vulnerability allows attackers to spoof valid certificate chains when the system root store is in use.
A workaround is present in Go 1.12.6+ and Go 1.13.7+, but affected users should additionally install the Windows security update to protect their system.
See https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-0601 for details on the Windows vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free