Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeIgnore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.
This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.
In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy