CVE-2020-0601: Windows CryptoAPI Spoofing Vulnerability in golang
Summary
CVE-2020-0601: A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate... Affects golang across 2 version ranges.
>= 1.12.0, < 1.12.16
>= 1.13.0, < 1.13.7
Fixed in 1.12.16 or 1.13.7, depending on the release line you run. How to fix ↓
Also tracked for
- stdlib · Go
The same CVE-2020-0601 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, also known as Go, is an open-source programming language developed by Google. It is designed to be efficient, secure, and easy to use. Golang is widely used for building various types of applications, including web servers, network tools, and distributed systems. However, the golang package is vulnerable to a spoofing vulnerability in the Windows CryptoAPI (Crypt32.dll) library. This vulnerability allows an attacker to use a spoofed code-signing certificate to sign a malicious executable, making it appear as if the file is from a trusted source.
Vulnerability Detail
The Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601) affects the golang package. The vulnerability arises from the way the Windows CryptoAPI validates Elliptic Curve Cryptography (ECC) certificates. By exploiting this vulnerability, an attacker can sign a malicious executable with a spoofed code-signing certificate, tricking users into believing that the file is from a trusted source. This can lead to various malicious activities, such as the execution of unauthorized code, data theft, or system compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.12.0, < 1.12.161.12.16 -
>= 1.13.0, < 1.13.71.13.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can disable the use of ECC certificates in the golang application. This can be achieved by modifying the application's code to enforce the use of other certificate types, such as RSA certificates. However, this workaround may impact the application's compatibility with certain features or requirements that rely on ECC certificates. It is recommended to consult the golang documentation or seek assistance from the golang community for guidance on implementing this workaround.
Conclusion
The golang package is vulnerable to the Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601). To mitigate this vulnerability, it is crucial to update the golang package to the recommended versions or apply the provided workaround. Regularly monitoring for vulnerabilities using tools like Vulert can help ensure the security of your golang applications. For additional support and guidance, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
The vulnerability allows an attacker to sign a malicious executable with a spoofed code-signing certificate, making it appear as if the file is from a trusted source. This can lead to the execution of unauthorized code, data theft, or system compromise.
To fix the vulnerability, update the golang package to version 1.12.16 or later (for golang 1.12.x) or version 1.13.7 or later (for golang 1.13.x). These versions include patches to address the vulnerability.
A workaround is to disable the use of ECC certificates in the golang application by enforcing the use of other certificate types, such as RSA certificates. However, this workaround may impact compatibility with certain features or requirements that rely on ECC certificates.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your golang application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
For further support on vulnerability remediation in golang, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing the Windows CryptoAPI Spoofing Vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
