CVE-2023-39323

Katalog CVE

CVSS 8.1 · High EPSS 1,9%

Kerentanan pada golang go, fedoraproject fedora. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

Rincian

Terbit di NVD

5 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 79,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pkg.go.dev/vuln/GO-2023-2095 advisory vendor
• https://go.dev/cl/533215 patch
• https://go.dev/issue/63211 issue tracking · patch
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQ... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DW... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7... mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202311-09 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20231020-0001/ advisory pihak ketiga
• https://groups.google.com/g/golang-announce/c/XBa1oHDevAo mailing list · release notes