Go Module Checksum Database Transparency Log Bypass

An attacker controlling or able to influence both the configured Go module proxy and checksum database can cause clients to consume malicious dependency content without detection through normal transparency-log verification. This can compromise the integrity of builds and downstream artifacts and may enable execution of attacker-controlled code during build, test, or deployment, depending on the affected module and build workflow.

Until patched, use only trusted, administratively controlled module proxies and checksum databases; restrict modification of GOPROXY and GOSUMDB configuration; pin and review dependencies; and validate build inputs and resulting artifacts through independent provenance or integrity controls. No specific workaround is available.

Apply vendor updates that incorporate the fix. For affected Tanzu buildpack deployments, use the applicable remediated release, including Go Buildpack 1.10.94, Staticfile Buildpack 1.6.96, Ruby Buildpack 1.10.87, Python Buildpack 1.8.108, R Buildpack 1.2.85, HWC Buildpack 3.1.114, NGINX Buildpack 1.2.95, NodeJS Buildpack 1.9.14, or .NET Core Buildpack 2.4.108, as applicable. Regenerate dependency checksum and vendor state using the documented dependency refresh procedure, then review resulting dependency changes before accepting them.