要点
- CVE-2017-15042 是影响 stdlib, go (golang) 的中危 (CVSS 5.9)漏洞。
- 未来 30 天内被利用的概率（EPSS）：1.3%，高于 70.1% 的漏洞。
- 修复：升级到 1.8.4, 1.9.1 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| stdlib Go | ≥ 1.1.0-0, < 1.8.4≥ 1.9.0-0, < 1.9.1
| 1.8.41.9.1
|
| go | = 1.9≤ 1.8.3
| No fix yet |
Description
SMTP clients using net/smtp can use the PLAIN authentication scheme on network connections not secured with TLS, exposing passwords to man-in-the-middle SMTP servers.
NVD description
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free