CVE-2017-15042
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires...
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
- Record
CVE-2017-15042- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-319
- Updated
- 2026-11-02
CVE List No score
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
- Record
CVE-2017-15042- Updated
- 2026-11-02
EUVDEUVD-2017-6517 No score
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
- Record
EUVD-2017-6517- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-crv5-fmcw-6rw4
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires...
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
- Record
GHSA-crv5-fmcw-6rw4- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-319
- Updated
- 2026-11-02
OSVAZL-79072
CVE-2017-15042 affecting package golang 1.25.7-1
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
- Record
AZL-79072- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVAZL-98781
CVE-2017-15042 affecting package golang 1.27.1-1
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
- Record
AZL-98781- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 12 moreShow less
OSV
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
- Record
CVE-2017-15042- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2017:3463
Red Hat Security Advisory: go-toolset-7 and go-toolset-7-golang security and bug fix update
- Record
RHSA-2017:3463- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2018:0878
Red Hat Security Advisory: golang security, bug fix, and enhancement update
- Record
RHSA-2018:0878- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-15042
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
- Record
UBUNTU-CVE-2017-15042- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGO-2021-0178 No score
Cleartext transmission of credentials in net/smtp
SMTP clients using net/smtp can use the PLAIN authentication scheme on network connections not secured with TLS, exposing passwords to man-in-the-middle SMTP servers.
- Record
GO-2021-0178- Updated
- 2026-11-02
OSVMGASA-2018-0089 No score
Updated golang packages fix security vulnerabilities
An arbitrary command execution flaw was found in the way Go's "go get" command handled the checkout of source code repositories. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side (CVE-2017-15041).
It was found that smtp.PlainAuth authentication scheme in Go did not verify the TLS requirement properly. A remote man-in-the-middle attacker could potentially use this flaw to sniff SMTP credentials sent by a Go application (CVE-2017-15042).
- Record
MGASA-2018-0089- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10802-1 No score
go-1.17-1.1 on GA media
These are all security issues fixed in the go-1.17-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10802-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10803-1 No score
go1.10-1.10.8-8.2 on GA media
These are all security issues fixed in the go1.10-1.10.8-8.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10803-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10804-1 No score
go1.11-1.11.13-10.5 on GA media
These are all security issues fixed in the go1.11-1.11.13-10.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10804-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10805-1 No score
go1.12-1.12.17-4.8 on GA media
These are all security issues fixed in the go1.12-1.12.17-4.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10805-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10811-1 No score
go1.4-1.4.3-12.2 on GA media
These are all security issues fixed in the go1.4-1.4.3-12.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10811-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10812-1 No score
go1.9-1.9.7-11.2 on GA media
These are all security issues fixed in the go1.9-1.9.7-11.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10812-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
golangAzure Linux:3 |
through 1.25.7-1 | None known |
golangAzure Linux:3 |
1.27.0 to 1.27.1-1 | None known |
stdlibGo |
1.1.0-0 up to 1.8.4, 1.9.0-0 up to 1.9.1 | 1.8.41.9.1 |
golangMageia:6 From an advisory covering 2 CVEs |
before 1.9.1-1.mga6 | 1.9.1-1.mga6 |
go-toolset-7Red Hat:devtools:2::el7 From an advisory covering 2 CVEs |
before 0:1.8-10.el7 | 0:1.8-10.el7 |
go-toolset-7-buildRed Hat:devtools:2::el7 From an advisory covering 2 CVEs |
before 0:1.8-10.el7 | 0:1.8-10.el7 |
go-toolset-7-dockerfilesRed Hat:devtools:2::el7 From an advisory covering 2 CVEs |
before 0:1.8-10.el7 | 0:1.8-10.el7 |
go-toolset-7-golangRed Hat:devtools:2::el7 From an advisory covering 2 CVEs |
before 0:1.8.5-1.el7 | 0:1.8.5-1.el7 |
go-toolset-7-golang-binRed Hat:devtools:2::el7 From an advisory covering 2 CVEs |
before 0:1.8.5-1.el7 | 0:1.8.5-1.el7 |
go-toolset-7-golang-docsRed Hat:devtools:2::el7 From an advisory covering 2 CVEs |
before 0:1.8.5-1.el7 | 0:1.8.5-1.el7 |
Show 20 moreShow less
| Package | Affected | Fixed |
|---|---|---|
go-toolset-7-golang-miscRed Hat:devtools:2::el7 From an advisory covering 2 CVEs |
before 0:1.8.5-1.el7 | 0:1.8.5-1.el7 |
go-toolset-7-golang-raceRed Hat:devtools:2::el7 From an advisory covering 2 CVEs |
before 0:1.8.5-1.el7 | 0:1.8.5-1.el7 |
go-toolset-7-golang-srcRed Hat:devtools:2::el7 From an advisory covering 2 CVEs |
before 0:1.8.5-1.el7 | 0:1.8.5-1.el7 |
go-toolset-7-golang-testsRed Hat:devtools:2::el7 From an advisory covering 2 CVEs |
before 0:1.8.5-1.el7 | 0:1.8.5-1.el7 |
go-toolset-7-runtimeRed Hat:devtools:2::el7 From an advisory covering 2 CVEs |
before 0:1.8-10.el7 | 0:1.8-10.el7 |
go-toolset-7-scldevelRed Hat:devtools:2::el7 From an advisory covering 2 CVEs |
before 0:1.8-10.el7 | 0:1.8-10.el7 |
golangRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:1.9.4-1.el7 | 0:1.9.4-1.el7 |
golang-binRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:1.9.4-1.el7 | 0:1.9.4-1.el7 |
golang-docsRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:1.9.4-1.el7 | 0:1.9.4-1.el7 |
golang-miscRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:1.9.4-1.el7 | 0:1.9.4-1.el7 |
golang-srcRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:1.9.4-1.el7 | 0:1.9.4-1.el7 |
golang-testsRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:1.9.4-1.el7 | 0:1.9.4-1.el7 |
golang-1.6Ubuntu:16.04:LTS |
All versions, plus listed versions 1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5 Show 5 moreShow less1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4 |
None known |
golang-1.8Ubuntu:18.04:LTS |
All versions, plus listed versions 1.8.3-2ubuntu11.8.3-2ubuntu1.18.04.1 |
None known |
goopenSUSE:Tumbleweed From an advisory covering 10 CVEs |
before 1.17-1.1 | 1.17-1.1 |
go1.10openSUSE:Tumbleweed From an advisory covering 12 CVEs |
before 1.10.8-8.2 | 1.10.8-8.2 |
go1.11openSUSE:Tumbleweed From an advisory covering 15 CVEs |
before 1.11.13-10.5 | 1.11.13-10.5 |
go1.12openSUSE:Tumbleweed From an advisory covering 18 CVEs |
before 1.12.17-4.8 | 1.12.17-4.8 |
go1.4openSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 1.4.3-12.2 | 1.4.3-12.2 |
go1.9openSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 1.9.7-11.2 | 1.9.7-11.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-15042 is a medium vulnerability (CVSS 5.9) in Golang Go, published October 5, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.28%, the 70th percentile. Fixed in stdlib 1.8.4.
References
access.redhat.com/errata/RHSA-2017:3463
securityfocus.com/bid/101197
golang.org/cl/68210
github.com/golang/go/issues/22134
Show 46 moreShow less
security.gentoo.org/glsa/201710-23
groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ
nvd.nist.gov/vuln/detail/CVE-2017-15042
go.dev/cl/68170
go.googlesource.com/go/+/ec3b6131de8f9c9c25283260c95c616c74f6d790
advisories.mageia.org/MGASA-2018-0089.html
bugs.mageia.org/show_bug.cgi?id=21857
lists.fedoraproject.org/archives/list/[email protected]/thread/AHH5B4WHCPTVEM6APRVXRWLFOR325CCD
bugzilla.redhat.com/show_bug.cgi?id=1498867
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3463.json
cve.org/CVERecord?id=CVE-2017-15041
ubuntu.com/security/CVE-2017-15042
suse.com/security/cve/CVE-2016-5386