CVE-2017-1000097 describes a vulnerability in Go programs running on Darwin where user-defined trust preferences for root certificates were ignored. Specifically, Go applications would still validate connections using root certificates explicitly marked as untrusted in the user's Keychain. This high-severity vulnerability (CVSS 7.5) has a network attack vector and low attack complexity, potentially leading to high integrity impact by allowing connections to untrusted entities. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.6.4CPE matchmatch criteria | cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | ||
>= 1.7, < 1.7.4CPE matchmatch criteria | cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate.
Oct 10, 2017golang: User's trust preferences for root certificates were not honored
Dec 1, 2016