USN-8883-1: Go vulnerability
AI summary · grok-4.7
Ubuntu fixed a Go x/net/idna flaw that can bypass hostname controls via Punycode labels.
Ubuntu USN-8883-1 fixes a vulnerability in Go's x/net/idna package. The package incorrectly handled certain Punycode-encoded labels that decoded to ASCII-only labels. Ubuntu says an attacker could use the issue to bypass hostname-based access controls and escalate privileges. The notice excerpt does not name a CVE or report in-the-wild exploitation.
- Flaw is in Go's x/net/idna Punycode handling.
- Certain labels decode to ASCII-only hostnames.
- Impact is hostname access-control bypass and possible privilege escalation.
- The notice names no CVE and reports no active exploitation.
Full article
It was discovered that the Go x/net/idna package incorrectly handled certain Punycode-encoded labels that decoded to ASCII-only labels. An attacker could possibly use this issue to bypass hostname-based access controls and escalate privileges.
This source does not provide full text. Read it at ubuntu.com.