| id: GO-2026-5052 | |
| modules: | |
| - module: software.sslmate.com/src/go-pkcs12 | |
| versions: | |
| - introduced: 0.6.0 | |
| - fixed: 0.7.2 | |
| vulnerable_at: 0.7.1 | |
| packages: | |
| - package: software.sslmate.com/src/go-pkcs12 | |
| symbols: | |
| - Decode | |
| - DecodeChain | |
| - DecodeTrustStore | |
| - ToPEM | |
| summary: Vulnerability in software.sslmate.com/src/go-pkcs12 | |
| description: |- | |
| Users who decode PKCS#12 files from untrusted sources and rely on the password | |
| for authentication can be tricked into accepting malicious PKCS#12 files. | |
| ghsas: | |
| - GHSA-mpwr-8vm7-h73f | |
| references: | |
| - advisory: https://github.com/SSLMate/go-pkcs12/security/advisories/GHSA-mpwr-8vm7-h73f | |
| - fix: https://github.com/SSLMate/go-pkcs12/commit/03c441f6b0267f695ca02464133c0b373bf4dd55 | |
| source: | |
| id: GHSA-mpwr-8vm7-h73f | |
| created: 2026-06-22T14:33:11.623265-04:00 | |
| review_status: REVIEWED |