CVE-2023-29404

Katalog CVE

CVSS 9.8 · Critical EPSS 1,8%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada golang go, fedoraproject fedora. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.

Rincian

Terbit di NVD

8 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pkg.go.dev/vuln/GO-2023-1841 advisory vendor
• https://go.dev/cl/501225 patch
• https://go.dev/issue/60305 issue tracking
• https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ mailing list · release notes
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJE...
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5... mailing list
• https://security.gentoo.org/glsa/202311-09
• https://security.netapp.com/advisory/ntap-20241115-0009/