CVE-2023-39320
Arbitrary code execution via go.mod toolchain directive in cmd/go
概要
Arbitrary code execution via go.mod toolchain directive in cmd/go
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.
影響パッケージ
Bitnami
golang
[{"type":"SEMVER","events":[{"introduced":"1.21.0"},{"fixed":"1.21.1"}]}]
参照URL
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- web go.dev
- web go.dev
- web groups.google.com
- web pkg.go.dev
- web pkg.go.dev