{"schema_version":"1.3.1","id":"GO-2021-0223","modified":"2024-05-20T16:03:47Z","published":"2022-02-17T17:46:03Z","aliases":["CVE-2020-14039"],"summary":"Certificate verification error on Windows in crypto/x509","details":"On Windows, if VerifyOptions.Roots is nil, Certificate.Verify does not check the EKU requirements specified in VerifyOptions.KeyUsages. This may allow a certificate to be used for an unintended purpose.","affected":[{"package":{"name":"stdlib","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.13.13"},{"introduced":"1.14.0-0"},{"fixed":"1.14.5"}]}],"ecosystem_specific":{"imports":[{"path":"crypto/x509","goos":["windows"],"symbols":["Certificate.systemVerify"]}]}}],"references":[{"type":"FIX","url":"https://go.dev/cl/242597"},{"type":"FIX","url":"https://go.googlesource.com/go/+/82175e699a2e2cd83d3aa34949e9b922d66d52f5"},{"type":"REPORT","url":"https://go.dev/issue/39360"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/XZNfaiwgt2w"}],"credits":[{"name":"Niall Newman"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2021-0223","review_status":"REVIEWED"}}