Summary
USN-8883-1 fixed a vulnerability in Go versions 1.18, 1.21, and 1.24. This
update provides the corresponding fix for Go version 1.23.
Original advisory details:
It was discovered that the Go x/net/idna package incorrectly handled
certain Punycode-encoded labels that decoded to ASCII-only labels. An
attacker could possibly use this issue to bypass hostname-based access
controls and escalate privileges.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | golang-1.23 | 1.23.1-1~22.04.3 |
Vulnerabilities 1
-
Critical 9.6
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …
References
-
report
https://ubuntu.com/security/CVE-2026-39821