CVE-2020-0601 Microsoft Windows CryptoAPI Spoofing
Attackers can spoof code-signing certificates to make malicious executables appear trusted, bypassing Windows CryptoAPI validation.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-0601?
CVE-2020-0601 is a high-severity vulnerability in Golang Go, published on 14 Jan 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.
Weakness: CWE-295
Which versions are affected by CVE-2020-0601?
2 open source packages ship an affected version, including golang and stdlib. It affects 13 products.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | From 1.12.0 | 1.12.16, 1.13.7 |
stdlib Go | All versions | 1.12.16, 1.13.7 |
Products include Golang Go, Microsoft Windows 10 1507, Microsoft Windows 10 1607, Microsoft Windows 10 1709, Microsoft Windows 10 1803, Microsoft Windows 10 1809 and 7 more.
How do I fix CVE-2020-0601?
Upgrade golang to a fixed version for your release line: 1.12.16 or 1.13.7. US federal agencies must fix it by 3 May 2022.
Is CVE-2020-0601 being exploited?
Yes. Attackers have exploited CVE-2020-0601 in the wild since at least 3 Nov 2021.
Public exploit code: 1 Exploit-DB entry and 35 proofs of concept on GitHub.
Other vulnerabilities in Golang Go
- CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile
- CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
- CVE-2023-39320 Arbitrary code execution via go.mod toolchain directive in cmd/go
- CVE-2023-24540 Improper handling of JavaScript whitespace in html/template
- CVE-2023-24538 Backticks not treated as string delimiters in html/template
Sources
Also known as BIT-golang-2020-0601, CLEANSTART-2025-WA86088, GHSA-82jc-cv6x-r223, GO-2022-0535.