15 Dec
2020
15 Dec
'20
4:55 p.m.
Hey Team,
In case you have not seen it yet, a new vulnerability in how Go handles XML has just been disclosed: https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
I suspect that we are indirectly impacted by this, although I have not read the disclosure in details yet. From a very cursory search in our code base, it looks like several vendored components may be directly hit. I don't see any immediate risk, in the sense that I don't think we expose any XML interface. But I may be wrong.
What do you think?
Thanks Christophe