Unsanitized NUL in environment variables on Windows in sysca… (CVE-2022-41716)

Résumé

Unsanitized NUL in environment variables on Windows in syscall and os/exec

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.18.8"},{"introduced":"1.19.0"},{"fixed":"1.19.3"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2022-41716 golang-1.15
Ubuntu UBUNTU-CVE-2022-41716 golang-1.10

Références

advisory security.netapp.com
advisory nvd.nist.gov
advisory github.com
web go.dev
web go.dev
web groups.google.com
web pkg.go.dev
web pkg.go.dev