CVE-2023-29402

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-29402
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://go.dev/cl/501226 Patch
https://go.dev/issue/60167 Issue Tracking
https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ Mailing List Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ Mailing List
https://pkg.go.dev/vuln/GO-2023-1839 Vendor Advisory
https://security.gentoo.org/glsa/202311-09
https://go.dev/cl/501226 Patch
https://go.dev/issue/60167 Issue Tracking
https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ Mailing List Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ Mailing List
https://pkg.go.dev/vuln/GO-2023-1839 Vendor Advisory
https://security.gentoo.org/glsa/202311-09
https://security.netapp.com/advisory/ntap-20241213-0004/
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
History

13 Dec 2024, 14:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20241213-0004/ -

21 Nov 2024, 07:56

Type Values Removed Values Added
References () https://go.dev/cl/501226 - Patch () https://go.dev/cl/501226 - Patch
References () https://go.dev/issue/60167 - Issue Tracking () https://go.dev/issue/60167 - Issue Tracking
References () https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ - Mailing List, Release Notes () https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ - Mailing List, Release Notes
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/ -
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ - Mailing List () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ - Mailing List
References () https://pkg.go.dev/vuln/GO-2023-1839 - Vendor Advisory () https://pkg.go.dev/vuln/GO-2023-1839 - Vendor Advisory
References () https://security.gentoo.org/glsa/202311-09 - () https://security.gentoo.org/glsa/202311-09 -

25 Nov 2023, 11:15

Type Values Removed Values Added
References
  • () https://security.gentoo.org/glsa/202311-09 -

11 Aug 2023, 03:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/ -

02 Aug 2023, 16:43

Type Values Removed Values Added
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ - Mailing List
CPE cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

21 Jul 2023, 04:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ -

16 Jun 2023, 14:12

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CWE CWE-94
CPE cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
References (MISC) https://go.dev/issue/60167 - (MISC) https://go.dev/issue/60167 - Issue Tracking
References (MISC) https://pkg.go.dev/vuln/GO-2023-1839 - (MISC) https://pkg.go.dev/vuln/GO-2023-1839 - Vendor Advisory
References (MISC) https://go.dev/cl/501226 - (MISC) https://go.dev/cl/501226 - Patch
References (MISC) https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ - (MISC) https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ - Mailing List, Release Notes

08 Jun 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-06-08 21:15

Updated : 2025-01-06 22:15

NVD link : CVE-2023-29402

Mitre link : CVE-2023-29402

CVE.ORG link : CVE-2023-29402

JSON object : View

Products Affected

fedoraproject

  • fedora

golang

  • go
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')