crypto/x509: certificate validation bypass on Windows 10

[katiehockman]

A Windows vulnerability allows attackers to spoof valid certificate chains when the system root store is in use. This issue is tracking a mitigation for Go applications, but it’s strongly recommended that affected users install the Windows security update to protect their system.

This issue is CVE-2020-0601.

[dmitshur]

Fixed in master (which will become Go 1.14) in commit 953bc8f.