High severity7.5OSV Advisory· Published Oct 5, 2017· Updated Jun 17, 2026

CVE-2017-1000097

Description

On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Golang/GoOSV3 versions
go1.3beta1, go1.3beta2, go1.4beta1, …+ 2 more
- (no CPE)range: go1.3beta1, go1.3beta2, go1.4beta1, …
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*range: <1.6.4
- (no CPE)

Patches

Vulnerability mechanics

References

github.com/golang/go/issues/18141nvdIssue TrackingThird Party Advisory
go-review.googlesource.com/c/33721/nvdBroken Link
groups.google.com/forum/nvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000