CVE-2022-41716
EUVD-2022-4489202.11.2022, 16:15
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| golang | go | 𝑥 < 1.18.8 |
| golang | go | 1.19.0 ≤ 𝑥 < 1.19.3 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| golang |
| ||||||||||||||||||
| golang-1.10 |
| ||||||||||||||||||
| golang-1.13 |
| ||||||||||||||||||
| golang-1.14 |
| ||||||||||||||||||
| golang-1.16 |
| ||||||||||||||||||
| golang-1.17 |
| ||||||||||||||||||
| golang-1.18 |
| ||||||||||||||||||
| golang-1.19 |
| ||||||||||||||||||
| golang-1.20 |
| ||||||||||||||||||
| golang-1.6 |
| ||||||||||||||||||
| golang-1.8 |
| ||||||||||||||||||
| golang-1.9 |
|
References