CVE-2017-15042: Medium severity Golang Go vulnerability
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
Other sources
It was found that smtp.PlainAuth scheme was vulnerable to man-in-the-middle attack. smtp.PlainAuth implementation would send the username and password to man-in-the-middle SMTP server that doesn’t advertise STARTTLS and does advertise that PLAIN auth is OK.
Upstream bug:
https://github.com/golang/go/issues/22134
Upstream patches:
Go 1.8: https://go-review.googlesource.com/c/go/+/68023 Go 1.9: https://go-review.googlesource.com/c/go/+/68210
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.8.4 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.9.1 - Upgrade
Upgrade
golang/goto a version that resolves this vulnerability.Fixed in 1.8.4 - Upgrade
Upgrade
golang/goto a version that resolves this vulnerability.Fixed in 1.9.1 - Compensating control
Ensure SMTP authentication using smtp.PlainAuth is only performed on network connections secured with TLS (RFC 4954); do not allow use of PLAIN on connections where STARTTLS is not advertised and available.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15042?
CVE-2017-15042 has a medium severity rating due to potential exposure of plaintext credentials.
How do I fix CVE-2017-15042?
To fix CVE-2017-15042, upgrade to Go version 1.8.4 or 1.9.1 or later.
Which versions of Go are affected by CVE-2017-15042?
CVE-2017-15042 affects Go versions prior to 1.8.4 and 1.9.x prior to 1.9.1.
What is the impact of CVE-2017-15042?
The impact of CVE-2017-15042 is that it allows sensitive user credentials to be transmitted in cleartext over SMTP connections.
What is the nature of the vulnerability in CVE-2017-15042?
CVE-2017-15042 is a cleartext credential exposure vulnerability that violates RFC 4954 requirements for SMTP PLAIN authentication.