GHSA-j443-wcqq-xprh: Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go
A critical vulnerability has been identified at https://security.snyk.io/package/linux/chainguard:latest/terraform-provider-sendgrid, associated with the underlying Go version.
If the server’s TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via Config.Clone() combined with modification or GetConfigForClient — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list.
As a result, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session.
References
- github.com/advisories/GHSA-h355-32pf-p2xm
- github.com/advisories/GHSA-j443-wcqq-xprh
- github.com/arslanbekov/terraform-provider-sendgrid
- github.com/arslanbekov/terraform-provider-sendgrid/security/advisories/GHSA-j443-wcqq-xprh
- security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-TERRAFORMPROVIDERSENDGRID-15265295
Code Behaviors & Features
Detect and mitigate GHSA-j443-wcqq-xprh with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →