Open Stack

Hey Team,


In case you have not seen it yet, a new vulnerability in how Go handles XML has just been disclosed:
https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/

I suspect that we are indirectly impacted by this, although I have not read the disclosure in details yet. From a very cursory search in our code base, it looks like several vendored components may be directly hit. I don't see any immediate risk, in the sense that I don't think we expose any XML interface. But I may be wrong.

What do you think?


Thanks
Christophe