Spoofing In github.com/google/go-eventlog
Description
Event type spoofing via UntrustedType in github.com/google/go-eventlog In github.com/google/go-eventlog/tcg, Event exposes UntrustedType, which returns the raw event type header from the TCG event log without verifying that the event data matches its digest. Callers that dispatch on Event.UntrustedType after ParseAndReplay can be tricked by a modified event type field for events whose digests are not verified against EventData.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 go | 0.0.3-0.20261001001437-1991f15bc4b0 |
Aliases
1. 2.
References
1. 2. 3. 4.