CVE-2020-14039: Medium severity IBM Security Guardium Insights vulnerability
Go could allow a remote attacker to bypass security restrictions, caused by improper validation on the VerifyOptions.KeyUsages EKU requirements during the X.509 certificate verification. An attacker could exploit this vulnerability to gain access to the system.
Other sources
In Go before 1.13.13 and 1.14.x before 1.14.5 Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus X.509 certificate verification is incomplete.
— Microsoft
In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.16.2-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.15.13-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.13.13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.14.5
Event History
Frequently Asked Questions
What is CVE-2020-14039?
CVE-2020-14039 is a vulnerability in Go versions before 1.13.13 and 1.14.x before 1.14.5 that allows a remote attacker to bypass security restrictions by exploiting improper validation on the VerifyOptions.KeyUsages EKU requirements during X.509 certificate verification.
What is the severity of CVE-2020-14039?
CVE-2020-14039 has a severity rating of medium with a CVSS score of 5.3.
How does CVE-2020-14039 impact Go?
CVE-2020-14039 could allow a remote attacker to gain access to the system by bypassing security restrictions in Go.
What versions of Go are affected by CVE-2020-14039?
Go versions before 1.13.13 and 1.14.x before 1.14.5 are affected by CVE-2020-14039.
How can I fix CVE-2020-14039?
To fix CVE-2020-14039, update to Go version 1.13.13 or upgrade to Go version 1.14.5 or later.