| Package | Affected versions | Patched versions |
|---|---|---|
| stdlib | ≥ 1.17.0-0, < 1.17.5< 1.16.12 | 1.17.51.16.12 |
| go | ≥ 1.17.0, < 1.17.5< 1.16.12 | 1.17.51.16.12 |
When a Go program running on a Unix system is out of file descriptors and calls syscall.ForkExec (including indirectly by using the os/exec package), syscall.ForkExec can close file descriptor 0 as it fails. If this happens (or can be provoked) repeatedly, it can result in misdirected I/O such as writing network traffic intended for one connection to a different connection, or content intended for one file to a different one.
For users who cannot immediately update to the new release, the bug can be mitigated by raising the per-process file descriptor limit.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free