CVE-2018-16886 (High) detected in github.com/google/certificate-transparency-go-v1.0.21

[mend-for-github-com]

CVE-2018-16886 - High Severity Vulnerability

Vulnerable Library - github.com/google/certificate-transparency-go-v1.0.21

Auditing for TLS certificates, Go code.

Dependency Hierarchy:

• github.com/cloudflare/cfssl/csr-v1.4.1 (Root Library)
  • github.com/cloudflare/cfssl/helpers-v1.4.1
    • ❌ github.com/google/certificate-transparency-go-v1.0.21 (Vulnerable Library)

Found in HEAD commit: 12c20c7fee37c61b9259a3a301be461c13f2cc2a

Vulnerability Details

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

Publish Date: 2019-01-14

URL: CVE-2018-16886

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-16886

Release Date: 2019-01-14

Fix Resolution: 3.2.26,3.3.11