Description
gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
go-pay gopay
Default version status: unaffected
0 to < 1.5.119affected
pkg:golang/github.com/go-pay/gopayReferences
- https://github.com/go-pay/gopay/issues/540 ↗
- https://github.com/go-pay/gopay/commit/f6df04fd4f64a2ad2c303ba063b6502bfdd259fd ↗
- https://github.com/go-pay/gopay/blob/v1.5.118/pkg/xhttp/client.go#L15-L37 ↗
- https://github.com/go-pay/gopay ↗
- https://www.vulncheck.com/advisories/gopay-before-1.5.119-disabled-tls-certificate-verification-in-xhttp-client ↗