[Bug 1147324] New: CVE-2014-7189 golang: TLS client authentication issue fixed in version 1.3.2

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1147324

Bug ID: 1147324
           Summary: CVE-2014-7189 golang: TLS client authentication issue
                    fixed in version 1.3.2
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail], [e-mail]

The Go 1.3.2 release fixes the following issue:

"The crpyto/tls fix addresses a security bug that affects programs that use
crypto/tls to implement a TLS server from Go 1.1 onwards. If the server enables
TLS client authentication using certificates (this is rare) and explicitly sets
SessionTicketsDisabled to true in the tls.Config, then a malicious client can
falsely assert ownership of any client certificate it wishes."

Upstream fix:

https://code.google.com/p/go/source/detail?r=eae0457c101512f59296538f0162749...

References:

http://seclists.org/oss-sec/2014/q3/749