CVE-2020-24553 Cross-site scripting in n/a
Cross-site scripting vulnerability in Go's CGI/FCGI handlers allows attackers to inject scripts when Content-Type headers are missing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-24553?
CVE-2020-24553 is a medium-severity cross-site scripting vulnerability in Fedoraproject Fedora, published on 2 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
Weakness: CWE-79
Which versions are affected by CVE-2020-24553?
2 open source packages ship an affected version, including golang and stdlib. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.14.8, 1.15.1 |
stdlib Go | All versions | 1.14.8, 1.15.1 |
Linux distribution packages (6)
go1.14 SUSE:Linux Enterprise Module for Development Tools 15 SP1 | All versions | 1.14.9-1.18.1 |
go1.15 SUSE:Linux Enterprise Module for Development Tools 15 SP1 | All versions | 1.15.2-1.3.1 |
go1.14 SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 1.14.9-1.18.1 |
go1.15 SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 1.15.2-1.3.1 |
go1.14 openSUSE:Leap 15.1 | All versions | 1.14.9-lp151.16.1 |
go1.14 openSUSE:Leap 15.2 | All versions | 1.14.9-lp152.2.6.1 |
Products include Fedoraproject Fedora, Golang Go, Opensuse Leap, Oracle Communications Cloud Native Core Policy.
How do I fix CVE-2020-24553?
Upgrade golang to a fixed version for your release line: 1.14.8 or 1.15.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-24553 being exploited?
There is no known exploitation of CVE-2020-24553 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-79064, AZL-98880, BIT-golang-2020-24553, DEBIAN-CVE-2020-24553, GHSA-pfr3-j9r8-5229, GO-2021-0226 and 7 more.