CVE-2023-29402
Code injection via go command with cgo in cmd/go
Résumé
Code injection via go command with cgo in cmd/go
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
Paquets affectés
Bitnami
golang
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.10"},{"introduced":"1.20.0"},{"fixed":"1.20.5"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2023-29402 golang-1.15
- Ubuntu UBUNTU-CVE-2023-29402 golang-1.10
Références
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- web go.dev
- web go.dev
- web groups.google.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web pkg.go.dev
- web pkg.go.dev