USN-8883-2: Go vulnerability
Ubuntu fixes a Go 1.23 x/net/idna Punycode flaw that could bypass hostname access controls.
Ubuntu published USN-8883-2, extending an earlier Go security fix to version 1.23 after USN-8883-1 covered 1.18, 1.21, and 1.24. The issue is in the x/net/idna package, which mishandled certain Punycode-encoded labels that decoded to ASCII-only labels. Ubuntu says an attacker could possibly use it to bypass hostname-based access controls and escalate privileges. The notice does not report active exploitation.
- USN-8883-2 backports the Go fix to version 1.23.
- USN-8883-1 already covered Go 1.18, 1.21, and 1.24.
- x/net/idna mishandled Punycode labels that decode to ASCII-only text.
- The flaw could bypass hostname access controls and escalate privileges.
USN-8883-1 fixed a vulnerability in Go versions 1.18, 1.21, and 1.24. This update provides the corresponding fix for Go version 1.23. Original advisory details: It was discovered that the Go x/net/idna package incorrectly handled certain Punycode-encoded labels that decoded to ASCII-only labels. An attacker could possibly use this issue to bypass hostname-based access controls and escalate privileges.
This source does not provide full text. Read it at ubuntu.com.