CVE-2020-28367
Summary
| CVE | CVE-2020-28367 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-11-18 17:15:00 UTC |
|---|
| Updated | 2023-11-07 03:21:00 UTC |
|---|
| Description | Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| cmd/go: improper validation of cgo flags can lead to remote code execution at build time · Issue #42556 · golang/go · GitHub |
MISC |
github.com |
Third Party Advisory |
| go.dev/cl/267277 |
MISC |
go.dev |
|
| [security] Go 1.15.5 and Go 1.14.12 are released |
|
groups.google.com |
|
| November 2020 Golang Vulnerabilities in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
|
| cmd/go: improper validation of cgo flags can lead to remote code execution at build time · Issue #42556 · golang/go · GitHub |
MISC |
go.dev |
|
| [SECURITY] [DLA 3395-1] golang-1.11 security update |
MISC |
lists.debian.org |
|
| da7aa86917811a571e6634b45a457f918b8e6561 - go - Git at Google |
|
go.googlesource.com |
|
| [SECURITY] [DLA 2460-1] golang-1.8 security update |
MLIST |
lists.debian.org |
Third Party Advisory |
| Go: Multiple Vulnerabilities (GLSA 202208-02) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| Pony Mail! |
MLIST |
lists.apache.org |
Mailing List, Vendor Advisory |
| [SECURITY] Fedora 32 Update: golang-1.14.13-1.fc32 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| GO-2022-0476 - Go Packages |
MISC |
pkg.go.dev |
|
| [SECURITY] Fedora 33 Update: golang-1.15.5-1.fc33 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 181743 Debian Security Update for golang-1.11 (DLA 3395-1)
- 352291 Amazon Linux Security Update for golang: AL2012-2021-332
- 501574 Alpine Linux Security Update for go
- 670178 EulerOS Security Update for golang (EulerOS-SA-2021-1678)
- 690435 Free Berkeley Software Distribution (FreeBSD) Security Update for go (db4b2f27-252a-11eb-865c-00155d646400)
- 710584 Gentoo Linux Go Multiple Vulnerabilities (GLSA 202208-02)
- 750526 OpenSUSE Security Update for go1.15 (openSUSE-SU-2020:2139-1)
- 750544 OpenSUSE Security Update for go1.14 (openSUSE-SU-2020:2067-1)
- 750559 OpenSUSE Security Update for go1.14 (openSUSE-SU-2020:2047-1)
- 900148 CBL-Mariner Linux Security Update for golang 1.13.15
- 902887 Common Base Linux Mariner (CBL-Mariner) Security Update for golang (3603)
- 907748 Common Base Linux Mariner (CBL-Mariner) Security Update for golang (3603-1)
- 940378 AlmaLinux Security Update for go-toolset:rhel8 (ALSA-2020:5493)
