Description
In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | go1.14 | 1.14.7-1.15.1 | SUSE-SU-2020:2562-1 |
| SLES 15 SP2 | terraform | 0.13.4-6.3.1 | SUSE-SU-2021:0263-1 |
| SLES 15 SP2 | terraform-provider-aws | 3.11.0-6.3.1 | SUSE-SU-2021:0263-1 |
| SLES 15 SP2 | terraform-provider-azurerm | 2.32.0-6.3.1 | SUSE-SU-2021:0263-1 |
| SLES 15 SP2 | terraform-provider-google | 3.43.0-6.3.1 | SUSE-SU-2021:0263-1 |
| SLES 15 SP2 | terraform-provider-helm | 1.3.2-6.3.1 | SUSE-SU-2021:0263-1 |
| SLES 15 SP2 | terraform-provider-kubernetes | 1.13.2-6.3.1 | SUSE-SU-2021:0263-1 |
| SLES 15 SP2 | terraform-provider-local +1 | 2.0.0-6.3.1 | SUSE-SU-2021:0263-1 |
| SLES 15 SP2 | terraform-provider-null +1 | 3.0.0-6.3.1 | SUSE-SU-2021:0263-1 |
| SLES 15 SP2 | terraform-provider-tls | 3.0.0-5.3.2 | SUSE-SU-2021:0263-1 |
| SLES 15 SP1 | go1.14 | 1.14.7-1.15.1 | SUSE-SU-2020:2562-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go1.13 | 1.13.15-2.6 | openSUSE-SU-2024:10806-1 |
| openSUSE Tumbleweed | go1.14 | 1.14.15-1.6 | openSUSE-SU-2024:10807-1 |
| openSUSE Tumbleweed | terraform-provider-helm | 2.0.0-1.4 | openSUSE-SU-2024:11430-1 |
| openSUSE Leap 15.2 | go1.13 | 1.13.14-lp152.2.4.1 | openSUSE-SU-2020:1095-1 |
| openSUSE Leap 15.2 | go1.14 | 1.14.7-lp152.2.3.1 | openSUSE-SU-2020:1407-1 |
| openSUSE Leap 15.1 | go1.13 | 1.13.14-lp151.5.1 | openSUSE-SU-2020:1087-1 |
| openSUSE Leap 15.1 | go1.14 | 1.14.7-lp151.13.1 | openSUSE-SU-2020:1405-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | stdlib | < 1.13.13 · >= 1.14.0-0, < 1.14.5 | 1.13.13, 1.14.5 | GO-2021-0223 |
Advisories 10
- openSUSE-SU-2024:10806-1 go1.13-1.13.15-2.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0263-1 Security update for terraform SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1095-1 Security update for go1.13 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11430-1 terraform-provider-helm-2.0.0-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:2562-1 Security update for go1.14 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1405-1 Security update for go1.14 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10807-1 go1.14-1.14.15-1.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1407-1 Security update for go1.14 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1087-1 Security update for go1.13 SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2023-1599 IBM Security Guardium: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 29, 2023
References
- https://groups.google.com/forum/#%21forum/golang-announce
- openSUSE-SU-2020:1087 vendor-advisory
- openSUSE-SU-2020:1095 vendor-advisory
- openSUSE-SU-2020:1405 vendor-advisory
- openSUSE-SU-2020:1407 vendor-advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w
- https://security.netapp.com/advisory/ntap-20200731-0005/