Certificate verification error on Windows in crypto/x509

中危 5.3CVE-2020-14039 · BIT-golang-2020-14039 · GO-2021-0223 · Published 17/07/2020 · updated 17/06/2026

要点

CVE-2020-14039 是影响 stdlib, go (golang) 的中危 (CVSS 5.3)漏洞。
未来 30 天内被利用的概率（EPSS）：1.8%，高于 78.0% 的漏洞。
修复：升级到 1.14.5, 1.13.13 或更高版本。

Package	Affected versions	Patched versions
stdlib Go	`≥ 1.14.0-0, < 1.14.5< 1.13.13`	`1.14.51.13.13`
go golang	`≥ 1.14.0, < 1.14.5< 1.13.13`	`1.14.51.13.13`

Description

On Windows, if VerifyOptions.Roots is nil, Certificate.Verify does not check the EKU requirements specified in VerifyOptions.KeyUsages. This may allow a certificate to be used for an unintended purpose.

NVD description

In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.

References

go.dev/cl/242597 · FIX
go.googlesource.com/go/+/82175e699a2e2cd83d3aa34949e9b922d66d52f5 · FIX
go.dev/issue/39360 · REPORT
groups.google.com/g/golang-announce/c/XZNfaiwgt2w · WEB
lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html · Mailing List
groups.google.com/forum
groups.google.com/forum
security.netapp.com/advisory/ntap-20200731-0005 · Third Party Advisory

stdlib 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

stdlib

≥ 1.14.0-0, < 1.14.5< 1.13.13

1.14.51.13.13

golang

≥ 1.14.0, < 1.14.5< 1.13.13

1.14.51.13.13

Description

NVD description

stdlib 的其他漏洞

查看全部 →