Описание
A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.
Отчет
This vulnerability is rated Important because Go applications validating TLS certificates could accept unauthorized certificates issued by distrusted intermediate Certificate Authorities, potentially compromising the integrity and confidentiality of secure network communications. Any Go-based client or server relying on standard certificate verification may be exposed to man-in-the-middle attacks if an attacker intercepts traffic using certificates derived from these intermediate keys. Exploitation requires specific network positioning and certificates generated by the untrusted intermediate authorities, limiting opportunistic widespread abuse.
Меры по смягчению последствий
See the security bulletin for a detailed mitigation procedure.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | helm | Affected | ||
| OpenShift Pipelines | openshift-pipelines-client | Affected | ||
| OpenShift Serverless | kn-workflow-plugin | Affected | ||
| OpenShift Serverless | openshift-serverless-clients | Affected | ||
| OpenShift Service Mesh 3 | istio-proxy | Affected | ||
| OpenShift Service Mesh 3 | openshift-golang-builder-container | Affected | ||
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy | Not affected | ||
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-openssl30 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-openssl32 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | receptor | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
6.8 Medium
CVSS3
Связанные уязвимости
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
On most platforms, Go uses the given system root certificates. However ...
ELSA-2026-500451: ca-certificates security update (IMPORTANT)
ELSA-2026-500450: ca-certificates security update (IMPORTANT)
ELSA-2026-500449: ca-certificates security update (IMPORTANT)
EPSS
6.8 Medium
CVSS3