CVE-2023-39323

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
GoCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 23%
VendorProductVersion
golanggo
𝑥
< 1.20.9
golanggo
1.21.0 ≤
𝑥
< 1.21.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
golang-1.15
bullseye
vulnerable
bookworm
no-dsa
buster
postponed
golang-1.19
bookworm
vulnerable
bullseye
no-dsa
buster
postponed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
golang-1.17
oracular
dne
noble
dne
mantic
dne
jammy
Fixed 1.17.13-3ubuntu1.3
released
focal
dne
golang-1.18
oracular
dne
noble
dne
mantic
dne
jammy
Fixed 1.18.1-1ubuntu1.2
released
focal
Fixed 1.18.1-1ubuntu1~20.04.3
released
bionic
Fixed 1.18.1-1ubuntu1~18.04.4+esm1
released
xenial
Fixed 1.18.1-1ubuntu1~16.04.6+esm1
released
golang-1.19
oracular
dne
noble
dne
mantic
dne
lunar
ignored
jammy
dne
focal
dne
bionic
ignored
xenial
ignored
trusty
ignored
golang-1.20
oracular
dne
noble
dne
mantic
Fixed 1.20.8-1ubuntu0.23.10.1
released
lunar
Fixed 1.20.3-1ubuntu0.2
released
jammy
Fixed 1.20.3-1ubuntu0.1~22.04.1
released
focal
Fixed 1.20.3-1ubuntu0.1~20.04.1
released
bionic
ignored
xenial
ignored
trusty
ignored
golang-1.21
oracular
dne
noble
not-affected
mantic
Fixed 1.21.1-1ubuntu0.23.10.1
released
lunar
Fixed 1.21.1-1~ubuntu23.04.2
released
jammy
Fixed 1.21.1-1~ubuntu22.04.2
released
focal
Fixed 1.21.1-1~ubuntu20.04.2
released
bionic
ignored
xenial
ignored
trusty
ignored