CVE-2020-14039

In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.

• CWE-295

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.htmlMailing List, Third Party Advisory
• https://groups.google.com/forum/#%21forum/golang-announce
• https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w
• https://security.netapp.com/advisory/ntap-20200731-0005/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.htmlMailing List, Third Party Advisory
• https://groups.google.com/forum/#%21forum/golang-announce
• https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w
• https://security.netapp.com/advisory/ntap-20200731-0005/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory

Published

Jul 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1403A remote code execution vulnerability exists in the way that…7.5
• CVE-2020-14030An issue was discovered in Ozeki NG SMS Gateway through 4.17…7.2
• CVE-2020-14031An issue was discovered in Ozeki NG SMS Gateway through 4.17…7.2
• CVE-2020-14032ASRock 4x4 BOX-R1000 before BIOS P1.40 allows privilege esca…9.8
• CVE-2020-14033An issue was discovered in janus-gateway (aka Janus WebRTC S…9.8
• CVE-2020-14034An issue was discovered in janus-gateway (aka Janus WebRTC S…9.8
• CVE-2020-1404An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-14040The x/text package before 0.3.3 for Go has a vulnerability i…7.5
• CVE-2020-14042** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Site Scrip…6.1
• CVE-2020-14043** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Side Reque…8.8
• CVE-2020-14044** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Requ…7.2
• CVE-2020-14048Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 a…7.5