CVE-2019-12496 Hybrid Group Gobot Improper Certificate Validation vulnerability
The Gobot library's MQTT subsystem fails to verify root CA certificates by default, allowing attackers to bypass TLS security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-12496?
CVE-2019-12496 is a high-severity vulnerability in n/a, published on 31 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default.
Weakness: CWE-295
Which versions are affected by CVE-2019-12496?
3 open source packages ship an affected version, including github.com/hybridgroup/gobot. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hybridgroup/gobot Go | All versions | 1.12.1-0.20190521122906-c1aa4f867846 |
github.com/hybridgroup/gobot Go | All versions | 1.12.1-0.20190521122906-c1aa4f867846 |
github.com/hybridgroup/gobot Go | All versions | 1.12.1-0.20190521122906-c1aa4f867846 |
Products include Hybridgroup Gobot.
How do I fix CVE-2019-12496?
Upgrade github.com/hybridgroup/gobot to 1.12.1-0.20190521122906-c1aa4f867846 or later.
Is CVE-2019-12496 being exploited?
There is no known exploitation of CVE-2019-12496 in the wild and no public exploit code.
Sources
Also known as GHSA-vfxc-r2gx-v2vq, GO-2021-0083.