CVE-2022-30580
Summary
| CVE | CVE-2022-30580 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-08-10 20:15:00 UTC |
| Updated | 2023-11-07 03:47:00 UTC |
| Description | Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset. |
Risk And Classification
Problem Types: CWE-94
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 960ffa98ce73ef2c2060c84c7ac28d37a83f345e - go - Git at Google | MISC | go.googlesource.com | |
| go.dev/cl/403759 | MISC | go.dev | |
| [security] Go 1.18.3 and Go 1.17.11 are released | MISC | groups.google.com | |
| GO-2022-0532 - Go Packages | MISC | pkg.go.dev | |
| os/exec: Cmd.{Run,Start} should fail if Cmd.Path is unset · Issue #52574 · golang/go · GitHub | MISC | go.dev | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159981 Oracle Enterprise Linux Security Update for go-toolset:ol8addon (ELSA-2022-17956)
- 159984 Oracle Enterprise Linux Security Update for ol8addon (ELSA-2022-17957)
- 354890 Amazon Linux Security Advisory for golang : ALAS2-2023-2015
- 354901 Amazon Linux Security Advisory for golang : ALAS-2023-1731
- 355216 Amazon Linux Security Advisory for golang : ALAS2023-2023-175
- 356304 Amazon Linux Security Advisory for golang : ALASGOLANG1.19-2023-002
- 378599 Splunk Enterprise Third Party Package Updates for June (SVD-2023-0613)
- 378883 Splunk Enterprise August Third Party Package Updates (SVD-2023-0808)
- 502459 Alpine Linux Security Update for go
- 690876 Free Berkeley Software Distribution (FreeBSD) Security Update for go (15888c7e-e659-11ec-b7fe-10c37b4ac2ea)
- 753266 SUSE Enterprise Linux Security Update for go1.18 (SUSE-SU-2022:2005-1)
- 753436 SUSE Enterprise Linux Security Update for go1.17 (SUSE-SU-2022:2004-1)
- 754047 SUSE Enterprise Linux Security Update for go1.18-openssl (SUSE-SU-2023:2312-1)
- 902714 Common Base Linux Mariner (CBL-Mariner) Security Update for golang (10514)
- 902729 Common Base Linux Mariner (CBL-Mariner) Security Update for golang (10532)
- 903954 Common Base Linux Mariner (CBL-Mariner) Security Update for golang (10532-1)
- 903976 Common Base Linux Mariner (CBL-Mariner) Security Update for golang (10514-1)
- 907760 Common Base Linux Mariner (CBL-Mariner) Security Update for golang (10514-2)
- 907809 Common Base Linux Mariner (CBL-Mariner) Security Update for golang (10532-2)