{"id":"CVE-2020-14039","aliases":["AZL-79080","AZL-98574","BELL-CVE-2020-14039","BIT-golang-2020-14039","EUVD-2020-6205","GHSA-v8jf-78w9-hp93","GO-2021-0223","SUSE-SU-2020:2562-1","SUSE-SU-2021:0263-1","openSUSE-SU-2020:1087-1","openSUSE-SU-2020:1095-1","openSUSE-SU-2020:1405-1","openSUSE-SU-2020:1407-1","openSUSE-SU-2024:10806-1","openSUSE-SU-2024:10807-1","openSUSE-SU-2024:11430-1"],"status":"published","title":"In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the...","description":"In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01762,"percentile":0.78177,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2020-07-17T15:43:33Z","modified":"2026-10-24T10:30:30Z","fixes":[{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.13.13","1.14.5"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.13.13","1.14.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform","fixed_in":["0.13.4-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-aws","fixed_in":["3.11.0-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-azurerm","fixed_in":["2.32.0-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-external","fixed_in":["2.0.0-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-google","fixed_in":["3.43.0-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-helm","fixed_in":["1.3.2-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-kubernetes","fixed_in":["1.13.2-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-local","fixed_in":["2.0.0-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-null","fixed_in":["3.0.0-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-random","fixed_in":["3.0.0-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-tls","fixed_in":["3.0.0-5.3.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"terraform-provider-helm","fixed_in":["2.0.0-1.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.25.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.13.13"},{"introduced":"1.14.0"},{"fixed":"1.14.5"}]}]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.13.13"},{"introduced":"1.14.0-0"},{"fixed":"1.14.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP1","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.7-1.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.7-1.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.4-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-5.3.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.14-lp151.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"go1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.14-lp152.2.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.7-lp151.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.7-lp152.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.15-2.6"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.15-1.6"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1.4"}]}]}],"products":[{"vendor":"golang","product":"go"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://groups.google.com/forum/#%21forum/golang-announce","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20200731-0005/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14039","tags":["web"]},{"url":"https://groups.google.com/forum/#!forum/golang-announce"},{"url":"https://groups.google.com/forum/#!topic/golang-announce/XZNfaiwgt2w"},{"url":"https://github.com/advisories/GHSA-v8jf-78w9-hp93"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-14039","tags":["advisory"]},{"url":"https://go.dev/cl/242597","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/82175e699a2e2cd83d3aa34949e9b922d66d52f5","tags":["fix"]},{"url":"https://go.dev/issue/39360","tags":["report"]},{"url":"https://groups.google.com/g/golang-announce/c/XZNfaiwgt2w","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202562-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1164903","tags":["report"]},{"url":"https://bugzilla.suse.com/1169832","tags":["report"]},{"url":"https://bugzilla.suse.com/1170826","tags":["report"]},{"url":"https://bugzilla.suse.com/1172868","tags":["report"]},{"url":"https://bugzilla.suse.com/1174153","tags":["report"]},{"url":"https://bugzilla.suse.com/1174191","tags":["report"]},{"url":"https://bugzilla.suse.com/1174977","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16845","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210263-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1168921","tags":["report"]},{"url":"https://bugzilla.suse.com/1170264","tags":["report"]},{"url":"https://bugzilla.suse.com/1177421","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EQ5XLGDKB3NTUQ5I5XPWTRHM2CUY2C5T/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1149259","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6TN7IMXFQNIWPWCTWVOLRVJXRRQCR67T/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DMSI6TFFNOIMEI3XSXGHKMVCWZP2743Q/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U3IHSSMDNFW647PZERRLZDGVMXZUQPNM/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3115","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-14039","description":"In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.","status":"published","published":"2020-07-17T15:43:33Z","modified":"2024-08-04T12:32:14.665Z","updated_at":"2026-11-02T14:35:46.476719Z"}],"euvd":[{"id":"EUVD-2020-6205","description":"In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.","status":"published","published":"2020-07-17T15:43:33Z","modified":"2024-08-04T12:32:14Z","updated_at":"2026-11-03T03:07:35.697348Z"}],"ghsa":[{"id":"GHSA-v8jf-78w9-hp93","title":"In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the...","description":"In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.","status":"published","published":"2022-05-24T17:23:50Z","modified":"2023-02-11T05:05:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:54:04.413406Z"}],"nvd":[{"id":"CVE-2020-14039","description":"In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.","status":"published","published":"2020-07-17T16:15:11.327Z","modified":"2026-06-17T02:54:08.57Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:06:10.086163Z"}],"osv":[{"id":"AZL-79080","title":"CVE-2020-14039 affecting package golang 1.25.7-1","description":"In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.","status":"published","published":"2020-07-17T16:15:11Z","modified":"2026-04-21T04:34:37.345394Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"AZL-98574","title":"CVE-2020-14039 affecting package golang 1.27.1-1","description":"In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.","status":"published","published":"2020-07-17T16:15:11Z","modified":"2026-09-16T06:39:01Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BELL-CVE-2020-14039","title":"CVE-2020-14039 does not affect BellSoft software","status":"withdrawn","published":"2020-07-17T16:15:00Z","modified":"2026-01-26T09:46:51.029453Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2020-14039","description":"In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.","status":"published","published":"2020-07-17T16:15:11.327Z","modified":"2026-10-24T10:30:30.540177205Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"BIT-golang-2020-14039","description":"In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.","status":"published","published":"2024-03-06T11:08:29.284Z","modified":"2026-09-08T08:47:46.811505292Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"GO-2021-0223","title":"Certificate verification error on Windows in crypto/x509","description":"On Windows, if VerifyOptions.Roots is nil, Certificate.Verify does not check the EKU requirements specified in VerifyOptions.KeyUsages. This may allow a certificate to be used for an unintended purpose.","status":"published","published":"2022-02-17T17:46:03Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"openSUSE-SU-2020:1087-1","title":"Security update for go1.13","description":"This update for go1.13 fixes the following issues:\n\n- go1.13.14 (released 2020/07/16) includes fixes to the compiler,\n  vet, and the database/sql, net/http, and reflect packages\n  Refs bsc#1149259 go1.13 release tracking\n  * go#39925 net/http: panic on misformed If-None-Match Header with http.ServeContent\n  * go#39848 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes\n  * go#39823 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15\n  * go#39697 reflect: panic from malloc after MakeFunc function returns value that is also stored globally\n  * go#39561 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it tries to use an older version of dlv which only supports linux/amd64\n  * go#39538 net: TestDialParallel is flaky on windows-amd64-longtest\n  * go#39287 cmd/vet: update for new number formats\n  * go#40211 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586\n  * go#40209 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)\n  * go#38932 runtime: preemption in startTemplateThread may cause infinite hang\n  * go#36689 go/types, math/big: data race in go/types due to math/big.Rat accessors unsafe for concurrent use\n- Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is\n  not present bsc#1172868 gh#golang/go#35305\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-07-26T14:26:20Z","modified":"2025-05-07T18:11:29.50012Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1095-1","title":"Security update for go1.13","description":"This update for go1.13 fixes the following issues:\n\n- go1.13.14 (released 2020/07/16) includes fixes to the compiler,\n  vet, and the database/sql, net/http, and reflect packages\n  Refs bsc#1149259 go1.13 release tracking\n  * go#39925 net/http: panic on misformed If-None-Match Header with http.ServeContent\n  * go#39848 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes\n  * go#39823 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15\n  * go#39697 reflect: panic from malloc after MakeFunc function returns value that is also stored globally\n  * go#39561 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it tries to use an older version of dlv which only supports linux/amd64\n  * go#39538 net: TestDialParallel is flaky on windows-amd64-longtest\n  * go#39287 cmd/vet: update for new number formats\n  * go#40211 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586\n  * go#40209 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)\n  * go#38932 runtime: preemption in startTemplateThread may cause infinite hang\n  * go#36689 go/types, math/big: data race in go/types due to math/big.Rat accessors unsafe for concurrent use\n- Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is\n  not present bsc#1172868 gh#golang/go#35305\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-07-27T12:20:54Z","modified":"2026-02-04T04:12:03.321448Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1405-1","title":"Security update for go1.14","description":"This update for go1.14 fixes the following issues:\n\n- go1.14 was updated to version 1.14.7 \n- CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).\t  \n\n- go1.14.6 (released 2020-07-16) includes fixes to the go command,\n  the compiler, the linker, vet, and the database/sql,\n  encoding/json, net/http, reflect, and testing packages.\n  Refs bsc#1164903 go1.14 release tracking\n  Refs bsc#1174153 bsc#1174191\n  * go#39991 runtime: missing deferreturn on linux/ppc64le\n  * go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent\n  * go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes\n  * go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15\n  * go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally\n  * go#39636 reflect: DeepEqual can return true for values that are not equal\n  * go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va\nlues\n  * go#39562 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie\ns to use an older version of dlv which only supports linux/amd64\n  * go#39308 testing: streaming output loses parallel subtest associations\n  * go#39288 cmd/vet: update for new number formats\n  * go#39101 database/sql: context cancellation allows statements to execute after rollback\n  * go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes\n  * go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586\n  * go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)\n- Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is\n  not present bsc#1172868 gh#golang/go#35305\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-09-10T18:24:01Z","modified":"2026-02-04T02:50:16.518473Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1407-1","title":"Security update for go1.14","description":"This update for go1.14 fixes the following issues:\n\n- go1.14 was updated to version 1.14.7 \n- CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).\t  \n\n- go1.14.6 (released 2020-07-16) includes fixes to the go command,\n  the compiler, the linker, vet, and the database/sql,\n  encoding/json, net/http, reflect, and testing packages.\n  Refs bsc#1164903 go1.14 release tracking\n  Refs bsc#1174153 bsc#1174191\n  * go#39991 runtime: missing deferreturn on linux/ppc64le\n  * go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent\n  * go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes\n  * go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15\n  * go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally\n  * go#39636 reflect: DeepEqual can return true for values that are not equal\n  * go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va\nlues\n  * go#39562 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie\ns to use an older version of dlv which only supports linux/amd64\n  * go#39308 testing: streaming output loses parallel subtest associations\n  * go#39288 cmd/vet: update for new number formats\n  * go#39101 database/sql: context cancellation allows statements to execute after rollback\n  * go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes\n  * go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586\n  * go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)\n- Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is\n  not present bsc#1172868 gh#golang/go#35305\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-09-11T04:23:21Z","modified":"2026-02-04T02:22:41.91839Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:10806-1","title":"go1.13-1.13.15-2.6 on GA media","description":"These are all security issues fixed in the go1.13-1.13.15-2.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:27:13.150101Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10807-1","title":"go1.14-1.14.15-1.6 on GA media","description":"These are all security issues fixed in the go1.14-1.14.15-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:32:42.416924Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:11430-1","title":"terraform-provider-helm-2.0.0-1.4 on GA media","description":"These are all security issues fixed in the terraform-provider-helm-2.0.0-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:55:56.157396Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2020:2562-1","title":"Security update for go1.14","description":"This update for go1.14 fixes the following issues:\n\n- go1.14 was updated to version 1.14.7 \n- CVE-2020-16845: dUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (bsc#1174977).\t  \n\n- go1.14.6 (released 2020-07-16) includes fixes to the go command,\n  the compiler, the linker, vet, and the database/sql,\n  encoding/json, net/http, reflect, and testing packages.\n  Refs bsc#1164903 go1.14 release tracking\n  Refs bsc#1174153 bsc#1174191\n  * go#39991 runtime: missing deferreturn on linux/ppc64le\n  * go#39920 net/http: panic on misformed If-None-Match Header with http.ServeContent\n  * go#39849 cmd/compile: internal compile error when using sync.Pool: mismatched zero/store sizes\n  * go#39824 cmd/go: TestBuildIDContainsArchModeEnv/386 fails on linux/386 in Go 1.14 and 1.13, not 1.15\n  * go#39698 reflect: panic from malloc after MakeFunc function returns value that is also stored globally\n  * go#39636 reflect: DeepEqual can return true for values that are not equal\n  * go#39585 encoding/json: incorrect object key unmarshaling when using custom TextUnmarshaler as Key with string va\nlues\n  * go#39562 cmd/compile/internal/ssa: TestNexting/dlv-dbg-hist failing on linux-386-longtest builder because it trie\ns to use an older version of dlv which only supports linux/amd64\n  * go#39308 testing: streaming output loses parallel subtest associations\n  * go#39288 cmd/vet: update for new number formats\n  * go#39101 database/sql: context cancellation allows statements to execute after rollback\n  * go#38030 doc: BuildNameToCertificate deprecated in go 1.14 not mentioned in the release notes\n  * go#40212 net/http: Expect 100-continue panics in httputil.ReverseProxy bsc#1174153 CVE-2020-15586\n  * go#40210 crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements on Windows bsc#1174191 CVE-2020-14039 (Windows only)\n- Add patch to ensure /etc/hosts is used if /etc/nsswitch.conf is\n  not present bsc#1172868 gh#golang/go#35305\n","status":"published","published":"2020-09-07T15:10:08Z","modified":"2026-02-04T03:24:27.754562Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2021:0263-1","title":"Security update for terraform","description":"This update for terraform fixes the following issues:\n\n- Updated terraform to version 0.13.4 (bsc#1177421)\n\n  * Many features, bug fixes, and enhancements were made during this update. Please refer to the\n    terraform rpm changelog, for a full list of all changes.\n\n- The following terraform providers were updated:\n\n  * terraform-provider-aws\n  * terraform-provider-azurerm\n  * terraform-provider-external\n  * terraform-provider-google\n  * terraform-provider-helm\n  * terraform-provider-kubernetes\n  * terraform-provider-local\n  * terraform-provider-null\n  * terraform-provider-random\n  * terraform-provider-tls\n","status":"published","published":"2021-02-01T14:01:06Z","modified":"2026-02-04T04:24:54.323489Z","updated_at":"2026-11-02T15:53:48.690034Z"}]}}