From CL 69294:
In https://golang.org/cl/9390 I messed up and put the critical extension
test in the wrong function. Thus it only triggered for leaf certificates
and not for intermediates or roots.
In practice, this is not expected to have a security impact in the web
PKI.
Per @agl, we should backport this to Go 1.9 and Go 1.8 as part of our regular point releases, but it doesn't warrant a special pre-announced security release (because, as the description says, it "is not expected to have a security impact in web PKI").
From CL 69294:
Per @agl, we should backport this to Go 1.9 and Go 1.8 as part of our regular point releases, but it doesn't warrant a special pre-announced security release (because, as the description says, it "is not expected to have a security impact in web PKI").