Comment by philipwhiuk
8 hours ago
"proactively" doing some work.
The problem is Golang has it's own trust store. So you don't benefit from OS patching.
8 hours ago
"proactively" doing some work.
The problem is Golang has it's own trust store. So you don't benefit from OS patching.
That's not the case, Go uses the system store with an additional revoke/deny list in crypto/x509 because it allows updating a deployed application on an out of date or slow moving platform or OS.
This CVE is literally just "versions of the Go deny list don't contain the eMuhdra revokation yet". Older versions of Go will still deny certs signed through the compromised certificate if the system store already has the update.
It's an or situation, not and.
> Go uses the system store with an additional revoke/deny list in crypto/x509 because it allows updating a deployed application on an out of date or slow moving platform or OS.
Reminder: Neither the CVE nor the linked go alert seem to say that you have to recompile and redeploy your application with the new go version in order to take advantage of this change. Just updating the tool chain and go stdlib isn't enough, because this stuff gets baked into the resultant binary. This is unlike, say, python, Ruby, or java where updating the runtime may be sufficient, depending on your development and deployment model.