https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 18:10:08 +0000 https://cve.radiocsirt.org/vuln/cnvd-2017-30862 cnvd-2017-30862 https://cve.radiocsirt.org/vuln/cnvd-2017-30862 https://cve.radiocsirt.org/vuln/euvd-2026-78365 EUVD-2026-78365 https://cve.radiocsirt.org/vuln/euvd-2026-78365 https://cve.radiocsirt.org/vuln/fkie_cve-2017-15042 <p>An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn&#39;t advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.</p> <p>An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn&#39;t advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-15042 https://cve.radiocsirt.org/vuln/ghsa-crv5-fmcw-6rw4 <p>An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn&#39;t advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.</p> <p>An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn&#39;t advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.</p> https://cve.radiocsirt.org/vuln/ghsa-crv5-fmcw-6rw4 https://cve.radiocsirt.org/vuln/gsd-2017-15042 gsd-2017-15042 https://cve.radiocsirt.org/vuln/gsd-2017-15042 https://cve.radiocsirt.org/vuln/msrc_cve-2017-15042 msrc_CVE-2017-15042 https://cve.radiocsirt.org/vuln/msrc_cve-2017-15042 https://cve.radiocsirt.org/vuln/opensuse-su-2024:10802-1 <p>go-1.17-1.1 on GA media</p> <p>go-1.17-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:10802-1 https://cve.radiocsirt.org/vuln/rhsa-2017:3463 <p>golang: arbitrary code execution during &#34;go get&#34; or &#34;go get -d&#34; golang: smtp.PlainAuth susceptible to man-in-the-middle password harvesting</p> <p>golang: arbitrary code execution during &#34;go get&#34; or &#34;go get -d&#34; golang: smtp.PlainAuth susceptible to man-in-the-middle password harvesting</p> https://cve.radiocsirt.org/vuln/rhsa-2017:3463 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-15042 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: golang-1.6, Ubuntu:18.04:LTS: golang-1.8</p> <p>An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn&#39;t advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: golang-1.6, Ubuntu:18.04:LTS: golang-1.8</p> <p>An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn&#39;t advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-15042