—
GO-2026-6169
Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq
상세
When a connection specifies hostaddr without host, github.com/lib/pq dials the numeric hostaddr but performs .pgpass lookup using the default Config.Host value, localhost. If the passfile contains different credentials for localhost and the remote address, the driver selects the secret intended for the local database and sends it to the remote endpoint when that endpoint requests password authentication.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
Go / github.com/lib/pq
최초 영향 버전:
1.11.0 No fixed version published yet for github.com/lib/pq (go modules). Pin to a known-safe version or switch to an alternative.