CVE-2020-24553
Fixed in a distro release EPSS 4%
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
Products: golang go, fedoraproject fedora, opensuse leap, oracle communications_cloud_native_core_policy
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | stdlib | 1.14.8 |
| Go | stdlib | 1.15.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | golang | 1.15.3-1.amzn2.0.1 |
| Amazon Linux 2 | golang-bin | 1.15.3-1.amzn2.0.1 |
| Amazon Linux 2 | golang-docs | 1.15.3-1.amzn2.0.1 |
| Amazon Linux 2 | golang-misc | 1.15.3-1.amzn2.0.1 |
| Amazon Linux 2 | golang-race | 1.15.3-1.amzn2.0.1 |
| Amazon Linux 2 | golang-src | 1.15.3-1.amzn2.0.1 |
| Amazon Linux 2 | golang-tests | 1.15.3-1.amzn2.0.1 |
| Arch Linux | go | 1.15.1-1 |
| Debian 11 | golang-1.15 | 1.15.2-1 |
| Red Hat Enterprise Linux 8 | delve | 0:1.4.1-1.module+el8.3.0+7840+63dfb1ed |
| Red Hat Enterprise Linux 8 | delve-debuginfo | 0:1.4.1-1.module+el8.3.0+7840+63dfb1ed |
| Red Hat Enterprise Linux 8 | delve-debugsource | 0:1.4.1-1.module+el8.3.0+7840+63dfb1ed |
| Red Hat Enterprise Linux 8 | go-toolset | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat Enterprise Linux 8 | golang | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat Enterprise Linux 8 | golang-bin | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat Enterprise Linux 8 | golang-docs | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat Enterprise Linux 8 | golang-misc | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat Enterprise Linux 8 | golang-race | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat Enterprise Linux 8 | golang-src | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat Enterprise Linux 8 | golang-tests | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat serverless 1.0 | openshift-serverless-clients | 0:0.18.4-2.el8 |
| SUSE Linux Enterprise Module for Development Tools 15 SP1 | go1.14 | 1.14.9-1.18.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP1 | go1.15 | 1.15.2-1.3.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | go1.14 | 1.14.9-1.18.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | go1.15 | 1.15.2-1.3.1 |
| Ubuntu 14.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.10 | 1.10.4-2ubuntu1~16.04.2 |
| Ubuntu 16.04 LTS | golang-1.6 | no fix |
| Ubuntu 18.04 LTS | golang-1.10 | 1.10.4-2ubuntu1~18.04.2 |
| Ubuntu 18.04 LTS | golang-1.8 | no fix |
| Ubuntu 18.04 LTS | golang-1.9 | no fix |
| Ubuntu 20.04 LTS | golang-1.13 | no fix |
| Ubuntu 20.04 LTS | golang-1.14 | 1.14.3-2ubuntu2~20.04.2 |
| Ubuntu Pro 16.04 LTS | golang-1.13 | no fix |
| Ubuntu Pro 18.04 LTS | golang-1.13 | no fix |
| Ubuntu Pro 22.04 LTS | golang-1.13 | no fix |
| openSUSE Leap 15.1 | go1.14 | 1.14.9-lp151.16.1 |
| openSUSE Leap 15.2 | go1.14 | 1.14.9-lp152.2.6.1 |
| openSUSE Tumbleweed | go1.14 | 1.14.15-1.6 |
| openSUSE Tumbleweed | go1.15 | 1.15.15-1.2 |