GHSA-j443-wcqq-xprh: Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go

Should you act?

• Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with govulncheck ./....
• No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

Details

Summary

A critical vulnerability has been identified at https://security.snyk.io/package/linux/chainguard:latest/terraform-provider-sendgrid, associated with the underlying Go version.

If the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via Config.Clone() combined with modification or GetConfigForClient — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list.

As a result, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session.

Details

If the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via Config.Clone() combined with modification or GetConfigForClient — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list.

Consequently, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session.

CVSS: 10.0 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Sources and references

1. GitHub Advisory GHSA-j443-wcqq-xprh github.com
2. github.com github.com
3. github.com github.com
4. security.snyk.io security.snyk.io

Critical Go advisories · Today’s Security Digest