Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
Recommended action: Upgrade to 1.27.2 or 1.26.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.
Recommended action: Upgrade to 1.27.2 or 1.26.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Recommended action: Upgrade to 1.27.0-rc.3 (pre-release), 1.26.6 or 1.25.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Recommended action: Upgrade to 1.27.0-rc.3 (pre-release), 1.26.6 or 1.25.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.