Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Mageia 7: MGASA-2020-0424 Critical Vulnerability in Golang XSS Risk

mageia
Calendar Grey November 15, 2020
Dist Mageia Esm H88
Mageia's recent golang patch targets a security vulnerability in the net/http modules, effectively mitigating risks of XSS attacks.
A flaw was found in Go standard library packages

Summary

A flaw was found in Go standard library packages. Both the net/http/cgi and net/http/fcgi packages use a default Content-Type response header value of "text/html", rather than "text/plain". An attacker could exploit this in applications using these packages by uploading crafted files, allowing for a cross-site scripting attack (XSS) (CVE-2020-24553).

References

- https://bugs.mageia.org/show_bug.cgi?id=27324

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/CZBO7Q73GGWBVYIKNH2HNN44Q5IQND5W/

- - https://www.cve.org/CVERecord?id=CVE-2020-24553

Topics%20covered

Topics Covered

security advisory cross-site scripting web application golang Mageia content-type

Resolution

SRPMS

- 7/core/golang-1.13.15-2.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 15 Nov 2020
URL: https://advisories.mageia.org/MGASA-2020-0424.html
Type: security
CVE: CVE-2020-24553

Topics%20covered

Topics Covered

security advisory cross-site scripting web application golang Mageia content-type

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here