147 matches found
cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...
cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...
go-syso-build-rce-poc
Go .syso build-host execution This repository reproduces GO...
cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...
cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...
cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...
cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...
cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...
cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...
cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...
cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...
cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...
cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...
cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...
cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...
cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...
cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...
cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...
cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...
cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...