MEDIUM5.3

GO-2021-0223

Certificate verification error on Windows in crypto/x509

Quick fix

GO-2021-0223 — stdlib: upgrade to the fixed version with the command below.

go get stdlib@v1.13.13

Details

On Windows, if VerifyOptions.Roots is nil, Certificate.Verify does not check the EKU requirements specified in VerifyOptions.KeyUsages. This may allow a certificate to be used for an unintended purpose.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/stdlib

Introduced in: 0Fixed in: 1.13.13

Fixgo get stdlib@v1.13.13

References

https://go.dev/cl/242597[FIX]
https://go.googlesource.com/go/+/82175e699a2e2cd83d3aa34949e9b922d66d52f5[FIX]
https://go.dev/issue/39360[REPORT]
https://groups.google.com/g/golang-announce/c/XZNfaiwgt2w[WEB]