You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
149 lines
6.7 KiB
149 lines
6.7 KiB
11 months ago
|
<!DOCTYPE html>
|
||
|
|
<html lang="en">
|
||
|
|
<head>
|
||
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||
|
|
<meta http-equiv="content-type" content="text/html; charset=utf-8">
|
||
|
|
|
||
|
|
<!-- Enable responsiveness on mobile devices-->
|
||
|
|
<!-- viewport-fit=cover is to support iPhone X rounded corners and notch in landscape-->
|
||
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1, viewport-fit=cover">
|
||
|
|
|
||
|
|
<title>Julio Biason .Me 4.3</title>
|
||
|
|
|
||
|
|
<!-- CSS -->
|
||
|
|
<link rel="stylesheet" href="https://blog.juliobiason.me/print.css" media="print">
|
||
|
|
<link rel="stylesheet" href="https://blog.juliobiason.me/poole.css">
|
||
|
|
<link rel="stylesheet" href="https://blog.juliobiason.me/hyde.css">
|
||
|
|
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=PT+Sans:400,400italic,700|Abril+Fatface">
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
</head>
|
||
|
|
|
||
|
|
<body class=" ">
|
||
|
|
|
||
|
|
<div class="sidebar">
|
||
|
|
<div class="container sidebar-sticky">
|
||
|
|
<div class="sidebar-about">
|
||
|
|
|
||
|
|
<a href="https://blog.juliobiason.me"><h1>Julio Biason .Me 4.3</h1></a>
|
||
|
|
|
||
|
|
<p class="lead">Old school dev living in a 2.0 dev world</p>
|
||
|
|
|
||
|
|
|
||
|
|
</div>
|
||
|
|
|
||
|
|
<ul class="sidebar-nav">
|
||
|
|
|
||
|
|
|
||
|
|
<li class="sidebar-nav-item"><a href="/">English</a></li>
|
||
|
|
|
||
|
|
<li class="sidebar-nav-item"><a href="/pt">Português</a></li>
|
||
|
|
|
||
|
|
<li class="sidebar-nav-item"><a href="/tags">Tags (EN)</a></li>
|
||
|
|
|
||
|
|
<li class="sidebar-nav-item"><a href="/pt/tags">Tags (PT)</a></li>
|
||
|
|
|
||
|
|
|
||
|
|
</ul>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
|
||
|
|
<div class="content container">
|
||
|
|
|
||
|
|
<div class="post">
|
||
|
|
<h1 class="post-title">Commented Link: Coordinated disclosure of XML round-trip vulnerabilities in Go’s standard library</h1>
|
||
|
|
<span class="post-date">
|
||
|
|
2020-12-14
|
||
|
|
|
||
|
|
<a href="https://blog.juliobiason.me/tags/links/">#links</a>
|
||
|
|
|
||
|
|
<a href="https://blog.juliobiason.me/tags/go/">#go</a>
|
||
|
|
|
||
|
|
<a href="https://blog.juliobiason.me/tags/golang/">#golang</a>
|
||
|
|
|
||
|
|
<a href="https://blog.juliobiason.me/tags/google/">#google</a>
|
||
|
|
|
||
|
|
<a href="https://blog.juliobiason.me/tags/xml/">#xml</a>
|
||
|
|
|
||
|
|
<a href="https://blog.juliobiason.me/tags/vulnerability/">#vulnerability</a>
|
||
|
|
|
||
|
|
</span>
|
||
|
|
<p>Mattermost, along with Google, announced a <a href="https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/">vulnerability in the Go XML
|
||
|
|
stdlib</a>.
|
||
|
|
There is a bunch of things to unwrap in this announcement.</p>
|
||
|
|
<span id="continue-reading"></span>
|
||
|
|
<p>Before anything, I need to point out that I never liked Go. I don't
|
||
|
|
like the way they deal with the community, I don't like their error
|
||
|
|
reporting way and I don't like their code style. I take every chance
|
||
|
|
to bash the language. But this time, I think the brokenness went too
|
||
|
|
long.</p>
|
||
|
|
<p>First of all, sure, there is a vulnerability in the XML library. The
|
||
|
|
vulnerability by itself and not huge -- it basically means, by what I
|
||
|
|
got, that the library itself doesn't keep the order of elements inside
|
||
|
|
-- but its the use in some huge elements, like SAML, affects the way
|
||
|
|
the protocol works. So, basically, something that would look like a
|
||
|
|
well-formed XML/SAML content would be interpreted in the wrong way
|
||
|
|
'cause the system is changing the semantics of it by changing the
|
||
|
|
order.</p>
|
||
|
|
<p>Second, apparently, since the vulnerability was found, the go security
|
||
|
|
team have been working on fixing the issue, with no success. The
|
||
|
|
resolution after all this was "the root causes of the vulnerabilities
|
||
|
|
cannot be reliably addressed." That means that the stdlib now have a
|
||
|
|
vulnerability that can't be fixed.</p>
|
||
|
|
<p>Third, this vulnerability was found in August this year and only now,
|
||
|
|
four months later, the vulnerability was disclosed and announced that
|
||
|
|
it can't be fixed. This is extremely infuriating 'cause Google have a
|
||
|
|
project called "Project Zero", created to find and report
|
||
|
|
vulnerabilities in several products. The problem is this is the third
|
||
|
|
not-so-small vulnerability in go code, and none of them were found by
|
||
|
|
Porject Zero. On the other hand, they are pretty quick in pointing and
|
||
|
|
disclosing -- with a 30 day allowance -- issues in Windows or iOS, for
|
||
|
|
example.</p>
|
||
|
|
<p>Oh, and in case you're wondering what were the other issues, the first
|
||
|
|
was related to <a href="https://twitter.com/peter_szilagyi/status/1332047468004077569">the cryptographic
|
||
|
|
libraries</a>
|
||
|
|
and basically affected a bunch of Etherium applications. The second,
|
||
|
|
an issue with the "http" library, which could lead to <a href="https://www.bleepingcomputer.com/news/security/severe-flaws-in-kubernetes-expose-all-servers-to-dos-attacks/">a
|
||
|
|
denial-of-service in
|
||
|
|
Kubernetes</a>.</p>
|
||
|
|
<p>Also... Four months and no solution? That means there is something
|
||
|
|
seriously broken in go internal architecture that doesn't allow
|
||
|
|
something like ordering to be applied.</p>
|
||
|
|
<p>But back to the main issue: Fourth, the company that worked with
|
||
|
|
Google to find and helped in trying to fix the issues, pointed that
|
||
|
|
they don't believe the changes proposed by the go team will actually
|
||
|
|
fix the problem. By their words, it seems Google just want to throw
|
||
|
|
the issue under a rug and, when it blows up, they will say "it's your
|
||
|
|
own fault, we told you so".</p>
|
||
|
|
<p>Google solution is, basically, "we'll put in the documentation and
|
||
|
|
hope for the best". So, no fix at all. Honestly, the proper solution
|
||
|
|
would be remove the whole thing and let someone else, hopefully
|
||
|
|
smarter, write a proper XML library. We say no documentation is better
|
||
|
|
than wrong documentation, so no XML library is better than a broken,
|
||
|
|
vulnerable library.</p>
|
||
|
|
<p>Another solution is to create binds to libxml2, which is a C library
|
||
|
|
that powers a lot of other languages XML needs. This would mean that
|
||
|
|
the standard library would require external tools to properly build,
|
||
|
|
though.</p>
|
||
|
|
<p>Personally, with all that is going on with the language, using it for
|
||
|
|
any half-serious (or higher) project is completely stupid.</p>
|
||
|
|
<p>PS: Just after I posted this, someone send me an announcement from the
|
||
|
|
go team about a new release fixing a vulnerability in the stdlib "ssh"
|
||
|
|
library. Again, anything that is at least half-serious shouldn't use
|
||
|
|
go.</p>
|
||
|
|
|
||
|
|
</div>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
</div>
|
||
|
|
|
||
|
|
</body>
|
||
|
|
|
||
|
|
</html>
|