cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

golang: cmd/compile: possible memory corruption after bound check elimination

A flaw was found in the cmd/compile package in the Go standard library. The compiler fails to correctly check for integer overflow or underflow in arithmetic operations involving loop induction variables. As a result, the compiler allows invalid memory indexing to occur at runtime, potentially...

golang: cmd/compile: no-op interface conversion bypasses overlap checking

A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data...

cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...

cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...

cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be...

cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...