GHSA-j443-wcqq-xprh: Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go
A critical vulnerability has been identified at https://security.snyk.io/package/linux/chainguard:latest/terraform-provider-sendgrid, associated with the underlying Go version.
If the server’s TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via Config.Clone() combined with modification or GetConfigForClient — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list.
As a result, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session.
References
- github.com/advisories/GHSA-h355-32pf-p2xm
- github.com/advisories/GHSA-j443-wcqq-xprh
- github.com/arslanbekov/terraform-provider-sendgrid
- github.com/arslanbekov/terraform-provider-sendgrid/security/advisories/GHSA-j443-wcqq-xprh
- security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-TERRAFORMPROVIDERSENDGRID-15265295
Code Behaviors & Features
Detect and mitigate GHSA-j443-wcqq-xprh with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →