Уязвимость CVE-2020-24553: Информация
Описание
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
Важность: MEDIUM (6,1) Вектор: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Исправленные пакеты
Имя пакета | Ветка | Исправлено в версии | Версия в репозитории | Errata ID | № Задания | Состояние |
|---|---|---|---|---|---|---|
| golang | sisyphus | 1.15-alt1 | 1.22.3-alt1 | ALT-PU-2020-2608-1 | 256390 | Исправлено |
| golang | p10 | 1.15-alt1 | 1.21.10-alt1 | ALT-PU-2020-2608-1 | 256390 | Исправлено |
| golang | p9 | 1.14.9-alt1 | 1.15.15-alt1 | ALT-PU-2020-2852-1 | 257899 | Исправлено |
| golang | c10f1 | 1.15-alt1 | 1.21.10-alt1 | ALT-PU-2020-2608-1 | 256390 | Исправлено |
| golang | c9f2 | 1.14.9-alt1 | 1.20.11-alt1 | ALT-PU-2020-2852-1 | 257899 | Исправлено |
Ссылки на рекомендации, решения и инструменты
Ссылка | Ресурс |
|---|---|
| 20200902 [RT-SA-2020-004] Inconsistent Behavior of Go's CGI and FastCGI Transport May Lead to Cross-Site Scripting |
|
| http://packetstormsecurity.com/files/159049/Go-CGI-FastCGI-Transport-Cross-Site-Scripting.html |
|
| https://security.netapp.com/advisory/ntap-20200924-0003/ |
|
| openSUSE-SU-2020:1584 |
|
| openSUSE-SU-2020:1587 |
|
| https://www.oracle.com/security-alerts/cpuApr2021.html |
|
| N/A |
|
| https://www.redteam-pentesting.de/advisories/rt-sa-2020-004 |
|
| FEDORA-2020-741cfa13d0 | |
| https://groups.google.com/forum/#%21topic/golang-announce/8wqlSbkLdPs |