CVE Vulnerabilities

CVE-2017-15042

Cleartext Transmission of Sensitive Information

Published: Oct 05, 2017 | Modified: Apr 20, 2025
CVSS 3.x
5.9
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
5.3 MODERATE
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Ubuntu
LOW

An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesnt advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.

Weakness

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Affected Software

Name Vendor Start Version End Version
Go Golang * 1.8.3 (including)
Go Golang 1.9 (including) 1.9 (including)
Red Hat Developer Tools RedHat go-toolset-7-0:1.8-10.el7 *
Red Hat Developer Tools RedHat go-toolset-7-golang-0:1.8.5-1.el7 *
Red Hat Enterprise Linux 7 RedHat golang-0:1.9.4-1.el7 *
Golang Ubuntu trusty *
Golang Ubuntu vivid/ubuntu-core *
Golang-1.6 Ubuntu esm-infra/xenial *
Golang-1.6 Ubuntu trusty *
Golang-1.6 Ubuntu upstream *
Golang-1.6 Ubuntu xenial *
Golang-1.7 Ubuntu artful *
Golang-1.7 Ubuntu cosmic *
Golang-1.7 Ubuntu upstream *
Golang-1.7 Ubuntu zesty *
Golang-1.8 Ubuntu artful *
Golang-1.8 Ubuntu bionic *
Golang-1.8 Ubuntu cosmic *
Golang-1.8 Ubuntu esm-apps/bionic *
Golang-1.8 Ubuntu upstream *
Golang-1.8 Ubuntu zesty *
Golang-1.9 Ubuntu upstream *

Potential Mitigations

References