SMTP clients using net/smtp can use the PLAIN authentication scheme on network connections not secured with TLS, exposing passwords to man-in-the-middle SMTP servers.
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2021-0178" }
{ "imports": [ { "path": "net/smtp", "symbols": [ "plainAuth.Start" ] } ] }