Incorrect access control in the go command in cmd/go/internal/modfetch

概要

参考情報

• go.dev/cl/378400 · FIX
• go.googlesource.com/go/+/fa4d9b8e2bc2612960c80474fca83a4c85a974eb · FIX
• go.dev/issue/35671 · REPORT
• groups.google.com/g/golang-announce/c/SUsQn0aSgPQ · WEB
• security.gentoo.org/glsa/202208-02 · Third Party Advisory
• security.netapp.com/advisory/ntap-20220225-0006 · Third Party Advisory
• oracle.com/security-alerts/cpujul2022.html · Third Party Advisory

toolchain のその他の脆弱性

• CVE-2026-94447高 7.8Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a maliciou…
• CVE-2026-94444高 7.8Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY th…
• CVE-2026-56865高 8.4A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check an…
• CVE-2026-56864高 7.5A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coor…
• CVE-2026-42501高 7.5A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This …