CVE-2022-41716

Katalog CVE

CVSS 7.5 · High EPSS 0,85%

Kerentanan pada golang go. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".

Rincian

Terbit di NVD

2 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

EPSS (30 hari)

0,85% peluang dieksploitasi; lebih tinggi dari 57,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://go.dev/cl/446916 patch · advisory vendor
• https://go.dev/issue/56284 issue tracking · patch · advisory vendor
• https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ patch · release notes · advisory vendor
• https://pkg.go.dev/vuln/GO-2022-1095 advisory vendor
• https://security.netapp.com/advisory/ntap-20230120-0007/