CVE-2017-1000097: Mishandled trust preferences for root certificates on Darwin in crypto/x509
Summary
CVE-2017-1000097: Mishandled trust preferences for root certificates on Darwin in crypto/x509. Affects stdlib across 2 version ranges.
< 1.6.4
>= 1.7.0-0, < 1.7.4
Fixed in 1.6.4 or 1.7.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in the Go ecosystem provides a set of standard libraries for the Go programming language. One of the packages in stdlib is crypto/x509, which is responsible for handling X.509 certificates. X.509 is a standard format for public key certificates used in various cryptographic protocols. The crypto/x509 package in Go allows developers to parse, verify, and manipulate X.509 certificates.
The vulnerability described in this report affects the crypto/x509 package on the Darwin operating system. Darwin is the core of Apple's macOS and iOS operating systems. The vulnerability specifically relates to the mishandling of trust preferences for root certificates on Darwin.
Vulnerability Detail
The vulnerability arises from a failure to honor the user's trust preferences for root certificates on Darwin. When a user has a root certificate loaded in their Keychain that is explicitly marked as not trusted, a Go program using the crypto/x509 package would still verify a connection using that root certificate. This means that even if a user has explicitly indicated that a root certificate should not be trusted, a Go program on Darwin would still consider it as trusted, potentially leading to the acceptance of malicious or compromised certificates.
The impact of this vulnerability is that an attacker could potentially present a malicious or compromised certificate that would be accepted as valid by a Go program on Darwin, bypassing the user's trust preferences. This could lead to various security issues, such as man-in-the-middle attacks or the compromise of sensitive information transmitted over secure connections.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.6.41.6.4go get stdlib@v1.6.4 -
>= 1.7.0-0, < 1.7.41.7.4go get stdlib@v1.7.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can manually modify the trust preferences for root certificates in their Keychain on Darwin. By explicitly marking a root certificate as not trusted in the Keychain, developers can ensure that Go programs using the crypto/x509 package will also consider it as not trusted. However, this workaround is not recommended as it requires manual intervention and may not be practical for all use cases.
Conclusion
In conclusion, the mishandling of trust preferences for root certificates on Darwin in the crypto/x509 package of the Go stdlib poses a security risk by potentially accepting malicious or compromised certificates. Developers should update their Go installations to a version that includes the fix for this vulnerability and recompile their Go programs. Manual modification of trust preferences in the Keychain can be used as a workaround, but it is not recommended. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The impact of this vulnerability is that an attacker could potentially present a malicious or compromised certificate that would be accepted as valid by a Go program on Darwin, bypassing the user's trust preferences. This could lead to various security issues, such as man-in-the-middle attacks or the compromise of sensitive information transmitted over secure connections.
Versions of Go prior to 1.6.4 and 1.7.4 are affected by this vulnerability. Developers should ensure that they are using a version of Go that is equal to or greater than these versions.
To fix this vulnerability, developers should update their Go installations to a version that includes the fix for this issue. The fix for this vulnerability was introduced in Go version 1.6.4 and 1.7.4. Developers can visit the official Go website (https://golang.org/) and download the latest stable release. Once the new version is installed, developers should recompile their Go programs to ensure they are using the updated version of the crypto/x509 package.
As a workaround, developers can manually modify the trust preferences for root certificates in their Keychain on Darwin. By explicitly marking a root certificate as not trusted in the Keychain, developers can ensure that Go programs using the crypto/x509 package will also consider it as not trusted. However, this workaround is not recommended as it requires manual intervention and may not be practical for all use cases.
For more information about this vulnerability, you can refer to the official Go vulnerability database entry at https://pkg.go.dev/vuln/GO-2022-0171.
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
