Описание
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
A flaw was found in golang.org/x/mod/sumdb. A malicious Go checksum database (GOSUMDB) can serve arbitrary module content that is not recorded in the transparency log. This allows a coordinated Go proxy (GOPROXY) and GOSUMDB to deliver malicious module content to a client, which cannot be detected by examining the transparency log. This vulnerability could lead to a supply chain compromise, allowing attackers to distribute malicious code.
Отчет
This Important vulnerability in golang.org/x/mod/sumdb allows for a supply chain compromise where a malicious GOSUMDB can serve arbitrary module content, bypassing transparency log verification. This impacts the integrity of Go module dependencies in Red Hat products that utilize the Go toolchain and interact with GOSUMDB, posing a significant risk to development and deployment environments.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| ExternalDNS Operator | edo/external-dns-rhel9 | Not affected | ||
| Multicluster Engine for Kubernetes | multicluster-engine/hypershift-addon-rhel9-operator | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-chains-controller-rhel9 | Affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-cli-tkn-rhel9 | Affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-operator-proxy-rhel9 | Affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-operator-webhook-rhel9 | Affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-rhel9-operator | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-model-registry-rhel9 | Affected | ||
| Red Hat OpenShift distributed tracing 3 | rhosdt/opentelemetry-collector-rhel9 | Not affected | ||
| Cluster Observability Operator 1.5 | cluster-observability-operator/alertmanager-rhel9 | Fixed | RHSA-2026:74609 | 01.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
A malicious GOSUMDB was capable of serving arbitrary module content no ...
EPSS
8.1 High
CVSS3