{"id":"CVE-2017-15042","aliases":["AZL-79072","AZL-98781","EUVD-2017-6517","GHSA-crv5-fmcw-6rw4","GO-2021-0178","MGASA-2018-0089","RHSA-2017:3463","RHSA-2018:0878","UBUNTU-CVE-2017-15042","openSUSE-SU-2024:10802-1","openSUSE-SU-2024:10803-1","openSUSE-SU-2024:10804-1","openSUSE-SU-2024:10805-1","openSUSE-SU-2024:10811-1","openSUSE-SU-2024:10812-1"],"status":"published","title":"An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires...","description":"An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01282,"percentile":0.70241,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-319"],"published":"2017-10-05T21:00:00Z","modified":"2026-10-20T10:48:13Z","fixes":[{"ecosystem":"Go","package":"stdlib","fixed_in":["1.8.4","1.9.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.25.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"1.1.0-0"},{"fixed":"1.8.4"},{"introduced":"1.9.0-0"},{"fixed":"1.9.1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8-10.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8-10.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-dockerfiles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8-10.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8-10.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-scldevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8-10.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.13-10.5"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.17-4.8"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-12.2"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-11.2"}]}],"bundled":9}],"products":[{"vendor":"golang","product":"go"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:3463","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0878","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/101197","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://golang.org/cl/68210","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://golang.org/cl/68023","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","report"]},{"url":"https://github.com/golang/go/issues/22134","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","report"]},{"url":"https://security.gentoo.org/glsa/201710-23","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15042","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-crv5-fmcw-6rw4"},{"url":"https://go.dev/cl/68170","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/ec3b6131de8f9c9c25283260c95c616c74f6d790","tags":["fix"]},{"url":"https://go.dev/issue/22134","tags":["report"]},{"url":"https://groups.google.com/g/golang-dev/c/RinSE3EiJBI/m/kYL7zb07AgAJ","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0089.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21857","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/AHH5B4WHCPTVEM6APRVXRWLFOR325CCD/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498870","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3463.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15041","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15041","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15042","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15042","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/7/html/7.5_release_notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1543561","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0878.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6574","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6574","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6574","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-15042","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17596","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-15042","description":"An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.","status":"published","published":"2017-10-05T21:00:00Z","modified":"2024-08-05T19:42:22.302Z","updated_at":"2026-11-02T14:33:14.271248Z"}],"euvd":[{"id":"EUVD-2017-6517","description":"An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.","status":"published","published":"2017-10-05T21:00:00Z","modified":"2024-08-05T19:42:22Z","updated_at":"2026-11-03T02:23:15.298105Z"}],"ghsa":[{"id":"GHSA-crv5-fmcw-6rw4","title":"An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires...","description":"An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.","status":"published","published":"2022-05-13T01:43:37Z","modified":"2023-02-02T05:00:54Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:51:04.373532Z"}],"nvd":[{"id":"CVE-2017-15042","description":"An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.","status":"published","published":"2017-10-05T21:29:00.473Z","modified":"2026-06-17T01:07:10.853Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:04:01.734197Z"}],"osv":[{"id":"AZL-79072","title":"CVE-2017-15042 affecting package golang 1.25.7-1","description":"An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.","status":"published","published":"2017-10-05T21:29:00Z","modified":"2026-04-21T04:34:37.353477Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"AZL-98781","title":"CVE-2017-15042 affecting package golang 1.27.1-1","description":"An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.","status":"published","published":"2017-10-05T21:29:00Z","modified":"2026-09-16T06:39:01Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"CVE-2017-15042","description":"An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.","status":"published","published":"2017-10-05T21:29:00.473Z","modified":"2026-10-20T10:48:13.46717166Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"RHSA-2017:3463","title":"Red Hat Security Advisory: go-toolset-7 and go-toolset-7-golang security and bug fix update","status":"published","published":"2024-09-16T00:48:28Z","modified":"2026-06-26T10:36:08Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:0878","title":"Red Hat Security Advisory: golang security, bug fix, and enhancement update","status":"published","published":"2024-09-16T00:48:22Z","modified":"2026-06-26T10:36:54Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2017-15042","description":"An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.","status":"published","published":"2017-10-05T21:29:00Z","modified":"2025-10-24T04:46:32Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"GO-2021-0178","title":"Cleartext transmission of credentials in net/smtp","description":"SMTP clients using net/smtp can use the PLAIN authentication scheme on network connections not secured with TLS, exposing passwords to man-in-the-middle SMTP servers.","status":"published","published":"2022-01-07T20:35:00Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2018-0089","title":"Updated golang packages fix security vulnerabilities","description":"An arbitrary command execution flaw was found in the way Go's \"go get\"\ncommand handled the checkout of source code repositories. A remote\nattacker capable of hosting malicious repositories could potentially use\nthis flaw to cause arbitrary command execution on the client side\n(CVE-2017-15041).\n\nIt was found that smtp.PlainAuth authentication scheme in Go did not\nverify the TLS requirement properly. A remote man-in-the-middle attacker\ncould potentially use this flaw to sniff SMTP credentials sent by a Go\napplication (CVE-2017-15042).\n","status":"published","published":"2018-01-21T21:31:56Z","modified":"2026-04-16T06:24:11.553779908Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10802-1","title":"go-1.17-1.1 on GA media","description":"These are all security issues fixed in the go-1.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:22.419368Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10803-1","title":"go1.10-1.10.8-8.2 on GA media","description":"These are all security issues fixed in the go1.10-1.10.8-8.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:41.250328Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10804-1","title":"go1.11-1.11.13-10.5 on GA media","description":"These are all security issues fixed in the go1.11-1.11.13-10.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:47.136272Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10805-1","title":"go1.12-1.12.17-4.8 on GA media","description":"These are all security issues fixed in the go1.12-1.12.17-4.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:28:31.331263Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10811-1","title":"go1.4-1.4.3-12.2 on GA media","description":"These are all security issues fixed in the go1.4-1.4.3-12.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:40:11.062224Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10812-1","title":"go1.9-1.9.7-11.2 on GA media","description":"These are all security issues fixed in the go1.9-1.9.7-11.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:45.429147Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}