From dfdc5a339c9199828d762f3d1227adc63dc1583b Mon Sep 17 00:00:00 2001 From: Ranji Raj <64376506+ranjiGT@users.noreply.github.com> Date: Sun, 4 Oct 2026 23:07:34 +0200 Subject: [PATCH 1/2] Update GHSA-p6q5-cmw8-pqqg.json details and severity --- .../GHSA-p6q5-cmw8-pqqg.json | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/advisories/unreviewed/2026/10/GHSA-p6q5-cmw8-pqqg/GHSA-p6q5-cmw8-pqqg.json b/advisories/unreviewed/2026/10/GHSA-p6q5-cmw8-pqqg/GHSA-p6q5-cmw8-pqqg.json index 7643749dc01..f1ef4f599d6 100644 --- a/advisories/unreviewed/2026/10/GHSA-p6q5-cmw8-pqqg/GHSA-p6q5-cmw8-pqqg.json +++ b/advisories/unreviewed/2026/10/GHSA-p6q5-cmw8-pqqg/GHSA-p6q5-cmw8-pqqg.json @@ -7,13 +7,17 @@ "CVE-2026-105216" ], "summary": "go-micro disables TLS certificate verification by default", - "details": "go-micro v5.13.0 through v5.30.0 disables TLS certificate verification by default in its shared TLS configuration. The default `Config()` sets `InsecureSkipVerify` to true unless `MICRO_TLS_SECURE=true` is explicitly configured.\nAs a result, applications relying on the default TLS configuration may fail to authenticate the remote endpoint, potentially allowing a network-positioned attacker to perform a man-in-the-middle attack.\nThe affected TLS configuration is used by components including gRPC transport, HTTP and RabbitMQ brokers, and Consul and etcd registry integrations.\nIn v6.0.0, the default was changed to secure certificate verification (`InsecureSkipVerify=false`). Disabling verification now requires the explicit `MICRO_TLS_INSECURE=true` configuration.", + "details": "go-micro `v5.0.0` through `v5.30.0` disables TLS certificate verification by default in multiple client components. In `v5.13.0`, this behavior was centralized in the shared TLS configuration, where `Config()` sets InsecureSkipVerify to true unless ´MICRO_TLS_SECURE=true´ is explicitly configured. The default `Config()` sets `InsecureSkipVerify` to true unless `MICRO_TLS_SECURE=true` is explicitly configured.\nAs a result, applications relying on the default TLS configuration may fail to authenticate the remote endpoint, potentially allowing a network-positioned attacker to perform a man-in-the-middle attack.\nThe affected TLS configuration is used by components including gRPC transport, HTTP and RabbitMQ brokers, and Consul and etcd registry integrations.\nIn v6.0.0, the default was changed to secure certificate verification (`InsecureSkipVerify=false`). Disabling verification now requires the explicit `MICRO_TLS_INSECURE=true` configuration.", "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" - } - ], + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" + } +], "affected": [ { "package": { @@ -74,4 +78,4 @@ "github_reviewed_at": null, "nvd_published_at": "2026-10-04T18:16:34Z" } -} \ No newline at end of file +} From 9ecbb18fa583496d44161ec1ab02110d669237d7 Mon Sep 17 00:00:00 2001 From: Ranji Raj <64376506+ranjiGT@users.noreply.github.com> Date: Sun, 4 Oct 2026 23:13:54 +0200 Subject: [PATCH 2/2] Revise CVE-2026-105216 details for clarity Updated details for CVE-2026-105216 to clarify TLS certificate verification behavior changes in go-micro. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../2026/10/GHSA-p6q5-cmw8-pqqg/GHSA-p6q5-cmw8-pqqg.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/advisories/unreviewed/2026/10/GHSA-p6q5-cmw8-pqqg/GHSA-p6q5-cmw8-pqqg.json b/advisories/unreviewed/2026/10/GHSA-p6q5-cmw8-pqqg/GHSA-p6q5-cmw8-pqqg.json index f1ef4f599d6..923dfa6f246 100644 --- a/advisories/unreviewed/2026/10/GHSA-p6q5-cmw8-pqqg/GHSA-p6q5-cmw8-pqqg.json +++ b/advisories/unreviewed/2026/10/GHSA-p6q5-cmw8-pqqg/GHSA-p6q5-cmw8-pqqg.json @@ -7,7 +7,7 @@ "CVE-2026-105216" ], "summary": "go-micro disables TLS certificate verification by default", - "details": "go-micro `v5.0.0` through `v5.30.0` disables TLS certificate verification by default in multiple client components. In `v5.13.0`, this behavior was centralized in the shared TLS configuration, where `Config()` sets InsecureSkipVerify to true unless ´MICRO_TLS_SECURE=true´ is explicitly configured. The default `Config()` sets `InsecureSkipVerify` to true unless `MICRO_TLS_SECURE=true` is explicitly configured.\nAs a result, applications relying on the default TLS configuration may fail to authenticate the remote endpoint, potentially allowing a network-positioned attacker to perform a man-in-the-middle attack.\nThe affected TLS configuration is used by components including gRPC transport, HTTP and RabbitMQ brokers, and Consul and etcd registry integrations.\nIn v6.0.0, the default was changed to secure certificate verification (`InsecureSkipVerify=false`). Disabling verification now requires the explicit `MICRO_TLS_INSECURE=true` configuration.", + "details": "go-micro `v5.0.0` through `v5.30.0` disables TLS certificate verification by default in multiple client components. In `v5.13.0`, this behavior was centralized in the shared TLS configuration, where `Config()` sets `InsecureSkipVerify` to true unless `MICRO_TLS_SECURE=true` is explicitly configured.\nAs a result, applications relying on the default TLS configuration may fail to authenticate the remote endpoint, potentially allowing a network-positioned attacker to perform a man-in-the-middle attack.\nThe affected TLS configuration is used by components including gRPC transport, HTTP and RabbitMQ brokers, and Consul and etcd registry integrations.\nIn v6.0.0, the default was changed to secure certificate verification (`InsecureSkipVerify=false`). Disabling verification now requires the explicit `MICRO_TLS_INSECURE=true` configuration.", "severity": [ { "type": "CVSS_V3",