CVE-2023-39320

Katalog CVE

CVSS 9.8 · Critical EPSS 1,8%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada golang go. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.

Rincian

Terbit di NVD

8 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pkg.go.dev/vuln/GO-2023-2042 advisory vendor
• https://go.dev/cl/526158 patch
• https://security.netapp.com/advisory/ntap-20231020-0004/ advisory pihak ketiga
• https://go.dev/issue/62198 issue tracking
• https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ release notes
• https://security.gentoo.org/glsa/202311-09