CVE-2017-15042

Aliases:GO-2021-0178
Advisory lineage Upstream: 0 Downstream: 10
Modified
Published: 05 Oct 2017, 21:00
Last modified:05 Aug 2024, 19:42

Vulnerability Summary

Overall Risk (default)
low
24/100
CVSS Score
5.9 MEDIUM
v3.0 (nvd)
EPSS Score
0.18% LOW
0% probability -0.01%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 Oct 2017, 21:00
Published
Vulnerability first disclosed
05 Aug 2024, 19:42
Last Modified
Vulnerability information updated

Description

An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.

CVSS Metrics

  • v3.0•MEDIUM•Score: 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.18%• Percentile: 40%

Techniques & Countermeasures

  • CWE-319•Cleartext Transmission of Sensitive Information

    The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Affected Systems

  • golang•go

    ≤ 1.8.3 | 1.9

  • Go•stdlib

    ≥ 1.9.0-0, < 1.9.1

References (12)