—
GO-2024-3358
SQL injection in Apache Traffic Control in github.com/apache/trafficcontrol
Quick fix
GO-2024-3358 — github.com/apache/trafficcontrol/v8: upgrade to the fixed version with the command below.
go get github.com/apache/trafficcontrol/v8@v8.0.2Details
SQL injection in Apache Traffic Control in github.com/apache/trafficcontrol
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/apache/trafficcontrol
Introduced in:
0No fixed version published yet for github.com/apache/trafficcontrol (go modules). Pin to a known-safe version or switch to an alternative.
Go/github.com/apache/trafficcontrol/v8
Introduced in:
8.0.0Fixed in: 8.0.2Fix
go get github.com/apache/trafficcontrol/v8@v8.0.2References
- https://github.com/advisories/GHSA-vq94-9pfv-ccqr[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2024-45387[ADVISORY]
- http://www.openwall.com/lists/oss-security/2024/12/23/3[WEB]
- https://github.com/apache/trafficcontrol/releases/tag/v8.0.2[WEB]
- https://lists.apache.org/thread/t38nk5n7t8w3pb66z7z4pqfzt4443trr[WEB]