GHSA-vfxc-r2gx-v2vq

Hybrid Group Gobot Improper Certificate Validation vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2019-12496

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hybridgroup/gobot	< 1.12.1-0.20190521122906-c1aa4f867846	1.12.1-0.20190521122906-c1aa4f867846

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default. ### Specific Go Packages Affected github.com/hybridgroup/gobot/platforms/mqtt

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-12496 advisory
https://github.com/hybridgroup/gobot/commit/c1aa4f867846da4669ecf3bc3318bd96b7ee6f3f web
https://github.com/hybridgroup/gobot package
https://github.com/hybridgroup/gobot/compare/ed53198...7f973df web
https://github.com/hybridgroup/gobot/releases/tag/v1.13.0 web
https://pkg.go.dev/vuln/GO-2021-0083 web