Summary
It was discovered that Go applications incorrectly handled uploaded content. If
a user were tricked into visiting a malicious page, a remote attacker could
exploit this with a crafted file to conduct cross-site scripting (XSS) attacks.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | golang-1.10 | 1.10.4-2ubuntu1~16.04.2 |
| Ubuntu · 18.04 LTS 18.04:LTS | golang-1.10 | 1.10.4-2ubuntu1~18.04.2 |
| Ubuntu · 20.04 LTS 20.04:LTS | golang-1.14 | 1.14.3-2ubuntu2~20.04.2 |
Vulnerabilities 1
-
Unscored —
Cross-site scripting in net/http/cgi and net/http/fcgi
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
References
-
report
https://ubuntu.com/security/CVE-2020-24553