PT-2017-10802 · Apple+1 · Darwin+1

Published 2017-04-08 · Updated 2022-08-16 · CVE-2017-1000097

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Darwin (affected versions not specified)

Description The issue concerns the handling of root certificates on Darwin systems. Specifically, if a user has a root certificate loaded in their Keychain that is explicitly marked as not trusted, Go programs would still use this certificate to verify connections, thus not honoring the user's trust preferences.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2017-1440

AZL-79076

CVE-2017-1000097

GO-2022-0171

Affected Products

Alt Linux

Darwin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000097 · Security Note
• https://osv.dev/vulnerability/GO-2022-0171 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-79076 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000097 · Vendor Advisory
• https://github.com/golang/go/issues/18141 · Note
• https://go.dev/issue/18141 · Note
• https://groups.google.com/forum/#%21msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ · Note
• https://go.googlesource.com/go/+/7e5b2e0ec144d5f5b2923a7d5db0b9143f79a35a · Note
• https://go-review.googlesource.com/c/33721 · Note
• https://groups.google.com/g/golang-dev/c/4NdLzS8sls8/m/uIz8QlnIBQAJ · Note