A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Weakness
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cluster Observability Operator 1.5.3 | RedHat | cluster-observability-operator/alertmanager-rhel9:1790854499 | * |
| Cluster Observability Operator 1.5.3 | RedHat | cluster-observability-operator/cluster-observability-rhel9-operator:1790854599 | * |
| Red Hat Advanced Cluster Security for Kubernetes 4.11 | RedHat | advanced-cluster-security/rhacs-main-rhel9:1789411320 | * |
| Red Hat Advanced Cluster Security for Kubernetes 4.11 | RedHat | advanced-cluster-security/rhacs-rhel9-operator:1789411320 | * |