CVE-2017-1000097

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-10-05 · updated 2026-06-17
Weakness: CWE-295

Description

On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate.

Affected products

Go: before 1.6.4; from 1.7 before 1.7.4 — fixed in 1.6.4, 1.7.4

How to fix

Upgrade to a fixed version: Go 1.6.4, 1.7.4. Check the vendor advisory for mitigations.

References

https://github.com/golang/go/issues/18141
https://go-review.googlesource.com/c/33721/
https://groups.google.com/forum/#%21msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ
https://github.com/golang/go/issues/18141
https://go-review.googlesource.com/c/33721/
https://groups.google.com/forum/#%21msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ

Get alerted when CVE-2017-1000097 or the next vulnerability affects your stack