CVE-2023-29404
08.06.2023, 21:15
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.
| Vendor | Product | Version |
|---|---|---|
| golang | go | 𝑥 < 1.19.10 |
| golang | go | 1.20.0 ≤ 𝑥 < 1.20.5 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| golang |
| ||||||||||||||||||||
| golang-1.10 |
| ||||||||||||||||||||
| golang-1.13 |
| ||||||||||||||||||||
| golang-1.14 |
| ||||||||||||||||||||
| golang-1.16 |
| ||||||||||||||||||||
| golang-1.17 |
| ||||||||||||||||||||
| golang-1.18 |
| ||||||||||||||||||||
| golang-1.19 |
| ||||||||||||||||||||
| golang-1.20 |
| ||||||||||||||||||||
| golang-1.6 |
| ||||||||||||||||||||
| golang-1.8 |
| ||||||||||||||||||||
| golang-1.9 |
|
References