Man-in-the-middle attack in Go programming language - CVE-2017-15042

Vulnerability identifier: #VU12161

CSH Severity: Low

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-15042

CWE-ID: CWE-300

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists in the smtp.PlainAuth implementation due to an unintended cleartext issue. A remote attacker can conduct man-in-the-middle attack and gain the username and password.

Go programming language
Gentoo Linux
Amazon Linux AMI
Fedora
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power
go (Alpine package)
golang
go-toolset-7-golang (Red Hat package)
go-toolset-7 (Red Hat package)

Update to versions 1.8.4 or 1.9.1.

go (Alpine package) - update to 1.8.4-r0
golang - addressed in versions 1.7.6-2.el6, 1.7.6-3.fc25, 1.8.4-1.fc26, 1.9.1-1.fc27
go-toolset-7-golang (Red Hat package) - update to 1.8.5-1.el7
go-toolset-7 (Red Hat package) - update to 1.8-10.el7

• https://github.com/golang/go/issues/22134

• Gentoo update for Go
• Amazon Linux AMI update for golang
• Red Hat update for golang
• Man-in-the-middle attack in go (Alpine package)
• Fedora 26 update for golang
• Fedora 27 update for golang
• Fedora 25 update for golang
• Fedora EPEL 6 update for golang
• Red Hat Developer Tools update for go-toolset-7 and go-toolset-7-golang