Mundur

**Name of the Vulnerable Software and Affected Versions** Go (affected versions not specified) **Description** A malicious GOSUMDB can serve arbitrary module content that is not present in the transparency log. This allows a coordinating GOPROXY and GOSUMDB to deliver malicious module content to a client, which cannot be detected by evaluating the transparency log. **Recommendations** To determine if the system has been affected, execute the following command: `rm -r go.sum go.work.sum vendor/ && go mod tidy`.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Parsing an invalid SVCB (Service Binding) or HTTPS RR (Resource Record) can cause a panic when the size of a parameter value overflows the message buffer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** On Unix systems, opening a file in an os.Root improperly follows symbolic links to locations outside of the Root. This occurs when the final path component of a path is a symbolic link and the path ends in a forward slash (/). For instance, calling `root.Open("symlink/")` allows access to the target of the symbolic link even if it points outside the designated root directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Go (affected versions not specified) **Description** A flaw in the `go` command's validation of module checksums allows a malicious module proxy to bypass checksum database validation. This occurs when the checksum database returns a successful response that contains no entry for the module, leading the `go` command to incorrectly permit validation to succeed. Consequently, a malicious proxy can serve altered versions of the Go toolchain or modules. This is particularly critical when a different toolchain version is selected via the `GOTOOLCHAIN` environment variable, a `go.work` file, or a `go.mod` file, as the `go` command will download and execute the toolchain provided by the proxy. The issue affects users utilizing an untrusted module proxy (`GOMODPROXY`) or checksum database (`GOSUMDB`). **Recommendations** Upgrade the base Go toolchain. Users with a non-trusted `GOPROXY` can revalidate all dependencies of the current module by running "rm go.sum ; go mod tidy ; go mod verify".

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A flaw exists where a trusted template author can include a `<script>` tag with an empty `type` attribute or a `type` attribute containing ASCII whitespace. This causes the template execution to incorrectly escape data passed into the `<script>` block. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.