CVE-2017-15042
Summary
| CVE | CVE-2017-15042 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-10-05 21:29:00 UTC |
| Updated | 2019-10-03 00:03:00 UTC |
| Description | An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password. |
Risk And Classification
Problem Types: CWE-319
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| smtp.PlainAuth susceptible to man-in-the-middle password harvesting [Go 1.8] · Issue #22134 · golang/go · GitHub | CONFIRM | github.com | Issue Tracking, Patch, Vendor Advisory |
| golang.org/cl/68210 | CONFIRM | golang.org | Vendor Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Google Groups | CONFIRM | groups.google.com | Mailing List, Vendor Advisory |
| Go: Multiple vulnerabilities (GLSA 201710-23) — Gentoo Security | GENTOO | security.gentoo.org | Third Party Advisory |
| Golang Go CVE-2017-15042 Man in the Middle Information Disclosure Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| golang.org/cl/68023 | CONFIRM | golang.org | Issue Tracking, Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.