GHSA-j443-wcqq-xprh
Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: GHSA.
Açıklama
### Summary A critical vulnerability has been identified at https://security.snyk.io/package/linux/chainguard:latest/terraform-provider-sendgrid, associated with the underlying Go version. If the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via `Config.Clone()` combined with modification or `GetConfigForClient` — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list. As a result, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session. ### Details If the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via `Config.Clone()` combined with modification or `GetConfigForClient` — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list. Consequently, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/arslanbekov/terraform-provider-sendgrid | düzeltme belirtilmemiş |