An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1.
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 4 fixed, 3 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-319.
Summary
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | up to 1.8.3 | Vulnerable | Go standard library |
| cpe:2.3:a:golang:go:1.9:*:*:*:*:*:*:* | 1.9 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions up to 1.8.3 Vulnerable ·Go standard library
- cpe:2.3:a:golang:go:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·Go standard library
Remediation
Red Hat 2 advisories
- RHSA-2018:0878 Released 2018-04-10 · Red Hat rating Moderategolang security, bug fix, and enhancement update
- Red Hat Enterprise Linux Server Optional (v. 7) golang-1.9.4-1.el7, golang-bin-1.9.4-1.el7, golang-docs-1.9.4-1.el7 +3
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) golang-1.9.4-1.el7, golang-bin-1.9.4-1.el7, golang-docs-1.9.4-1.el7 +3
- RHSA-2017:3463 Released 2017-12-14 · Red Hat rating Moderatego-toolset-7 and go-toolset-7-golang security and bug fix update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-7-1.8-10.el7, go-toolset-7-build-1.8-10.el7, go-toolset-7-dockerfiles-1.8-10.el7 +9
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-7-1.8-10.el7, go-toolset-7-build-1.8-10.el7, go-toolset-7-dockerfiles-1.8-10.el7 +9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Enterprise 3 | Affected | No fix yet |
| Red Hat OpenStack Platform 8 (Liberty) Operational Tools | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 9 (Mitaka) Operational Tools | Affected | No fix planned: Will not fix |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2017:3463 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2017:3463 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2018:0878 |
| Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) | Fixed | RHSA-2018:0878 |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-15042
- 2026-10-03 Alias added: GHSA-crv5-fmcw-6rw4
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2017-15042 · CVE Program
- CVE-2017-15042 · NVD
- FIRST EPSS
- GHSA-crv5-fmcw-6rw4 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-15042 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences