Description
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
micro go-micro
Default version status: unaffected
0 to < 6.0.0affected
pkg:golang/go-micro.dev/v5References
- https://github.com/micro/go-micro/issues/2963 ↗
- https://github.com/micro/go-micro/commit/c7657f73f45cf839e643db10f28703eeab7299c3 ↗
- https://github.com/micro/go-micro/blob/v5.30.0/internal/util/tls/tls.go#L43-L67 ↗
- https://github.com/micro/go-micro ↗
- https://www.vulncheck.com/advisories/go-micro-before-6.0.0-disabled-tls-certificate-verification-via-tls-config-helper ↗