GoPackage

github.com/smallstep/certificates

4 known vulnerabilities (2 critical, 1 medium, 1 low), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-40097Low 3.7
Step CA affected by an index out of bounds panic in TPM attestation EKU validation
Affected: from 0.24.0, fixed in 0.30.0.
Fixed in v0.30.0 (released Mar 18, 2026, 23 days before disclosure).
The latest release, v0.30.2, is not affected.
CVE-2026-30836Critical 10.0
Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)
Affected: fixed in 0.30.0.
Fixed in v0.30.0 (released Mar 18, 2026, 1 day before disclosure).
The latest release, v0.30.2, is not affected.
CVE-2025-44005Critical 10.0
An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain…
Affected: fixed in 0.29.0.
Fixed in v0.29.0 (released Dec 3, 2025, 14 days before disclosure).
The latest release, v0.30.2, is not affected.
CVE-2025-66406Medium 5.0
Improper Authorization Check for SSH Certificate Revocation
Affected: fixed in 0.29.0.
Fixed in v0.29.0 (released Dec 3, 2025, the day of disclosure).
The latest release, v0.30.2, is not affected.