CVE-2017-15042
First published: Thu Oct 05 2017(Updated: )
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Golang Go | <=1.8.3 | |
| Golang Go | =1.9 | |
| redhat/golang | <1.8.4 | 1.8.4 |
| redhat/golang | <1.9.1 | 1.9.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/101197
- https://access.redhat.com/errata/RHSA-2017:3463
- https://access.redhat.com/errata/RHSA-2018:0878
- https://github.com/golang/go/issues/22134
- https://golang.org/cl/68023
- https://golang.org/cl/68210
- https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ
- https://security.gentoo.org/glsa/201710-23
- https://go-review.googlesource.com/c/go/+/68023
- https://go-review.googlesource.com/c/go/+/68210
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1498872
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1498873
- https://access.redhat.com/security/cve/CVE-2017-15042
- https://bugzilla.redhat.com/show_bug.cgi?id=1498867
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-15042
- agent/software-canonical-lookup
- vendor/golang
- canonical/golang go
- version/golang go/1.8.3
- version/golang go/1.9
- package-manager/redhat