Go GOPROXY sumdb tile-verification bypass

A malicious or network-compromised module proxy can poison dependency retrieval and cause builds to consume attacker-controlled Go module content while appearing to satisfy checksum-database validation. This compromises the integrity of software supply chains and can lead to arbitrary downstream effects determined by the malicious dependency, including code execution during builds or in produced applications, data compromise, and service disruption.

Do not use untrusted GOPROXY endpoints. Restrict module retrieval to approved internal proxies or trusted public proxies, enforce HTTPS and appropriate proxy configuration, and limit the ability of network intermediaries or untrusted users to alter module-proxy settings. Review and rebuild artifacts produced while vulnerable tooling and untrusted proxy infrastructure were in use.

Update Go to a release containing the corrected checksum-database tile-parent verification logic. Apply vendor-supported operating-system and product updates that incorporate the fixed Go package. For potentially exposed environments, remove existing module checksum, workspace checksum, and vendored dependency state, then regenerate dependencies with Go module tooling to ensure cached and vendored content is revalidated. Amazon Linux 2 systems using unsupported Golang 1.9, 1.11, or 1.19 Extra packages should migrate to a supported fixed Go package or operating-system release.