CVE-2020-14039: Medium severity ibm security guardium insights vulnerability
Go could allow a remote attacker to bypass security restrictions, caused by improper validation on the VerifyOptions.KeyUsages EKU requirements during the X.509 certificate verification. An attacker could exploit this vulnerability to gain access to the system.
Other sources
In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-14039?
CVE-2020-14039 is a vulnerability in Go versions before 1.13.13 and 1.14.x before 1.14.5 that allows a remote attacker to bypass security restrictions by exploiting improper validation on the VerifyOptions.KeyUsages EKU requirements during X.509 certificate verification.
What is the severity of CVE-2020-14039?
CVE-2020-14039 has a severity rating of medium with a CVSS score of 5.3.
How does CVE-2020-14039 impact Go?
CVE-2020-14039 could allow a remote attacker to gain access to the system by bypassing security restrictions in Go.
What versions of Go are affected by CVE-2020-14039?
Go versions before 1.13.13 and 1.14.x before 1.14.5 are affected by CVE-2020-14039.
How can I fix CVE-2020-14039?
To fix CVE-2020-14039, update to Go version 1.13.13 or upgrade to Go version 1.14.5 or later.