CyberRota Analysis
AI-GeneratedA vulnerability exists in the Go module system where a compromised GOSUMDB can deliver arbitrary module content that bypasses the transparency log, potentially allowing attackers to introduce malicious code into applications. This poses a significant risk to developers and organizations relying on Go modules for their software supply chain, as the integrity of the modules cannot be assured. Developers using Go should prioritize addressing this issue by following the recommended mitigation steps to ensure their environments are secure.
Original NVD Description
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy