https://bugzilla.redhat.com/show_bug.cgi?id=1404636
Bug ID: 1404636
Summary: golang: User's trust preferences for root certificates
were not honored
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: admiller(a)redhat.com, amurdaca(a)redhat.com,
aortega(a)redhat.com, apevec(a)redhat.com,
ayoung(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, chrisw(a)redhat.com,
cvsbot-xmlrpc(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jcajka(a)redhat.com, jgoulding(a)redhat.com,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
jschluet(a)redhat.com, kbasil(a)redhat.com,
kseifried(a)redhat.com, lemenkov(a)gmail.com,
lhh(a)redhat.com, lmeyer(a)redhat.com, lpeer(a)redhat.com,
markmc(a)redhat.com, mmccomas(a)redhat.com,
rbryant(a)redhat.com, renich(a)woralelandia.com,
sclewis(a)redhat.com, srevivo(a)redhat.com, s(a)shk.io,
tdawson(a)redhat.com, tdecacqu(a)redhat.com,
vbatts(a)redhat.com
It was found that user's trust preferences for root certificates were not
honored. If the user had a root certificate loaded in their Keychain that was
explicitly not trusted, a Go program would still verify a connection using that
root certificate.
Upstream bug:
https://github.com/golang/go/issues/18141
Upstream patch:
https://go-review.googlesource.com/#/c/33721/
External Reference:
https://groups.google.com/forum/#!msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ
--
You are receiving this mail because:
You are on the CC list for the bug.