CVE-2023-29405

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-29405
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://go.dev/cl/501224 Patch
https://go.dev/issue/60306 Issue Tracking
https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ Mailing List
https://pkg.go.dev/vuln/GO-2023-1842 Vendor Advisory
https://security.gentoo.org/glsa/202311-09
https://go.dev/cl/501224 Patch
https://go.dev/issue/60306 Issue Tracking
https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ Mailing List
https://pkg.go.dev/vuln/GO-2023-1842 Vendor Advisory
https://security.gentoo.org/glsa/202311-09
https://security.netapp.com/advisory/ntap-20241206-0003/
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
History

06 Dec 2024, 14:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20241206-0003/ -

21 Nov 2024, 07:56

Type Values Removed Values Added
References () https://go.dev/cl/501224 - Patch () https://go.dev/cl/501224 - Patch
References () https://go.dev/issue/60306 - Issue Tracking () https://go.dev/issue/60306 - Issue Tracking
References () https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ - Mailing List, Third Party Advisory () https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/ -
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ - Mailing List () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ - Mailing List
References () https://pkg.go.dev/vuln/GO-2023-1842 - Vendor Advisory () https://pkg.go.dev/vuln/GO-2023-1842 - Vendor Advisory
References () https://security.gentoo.org/glsa/202311-09 - () https://security.gentoo.org/glsa/202311-09 -

25 Nov 2023, 11:15

Type Values Removed Values Added
References
  • () https://security.gentoo.org/glsa/202311-09 -

11 Aug 2023, 03:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/ -

02 Aug 2023, 16:43

Type Values Removed Values Added
CPE cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ - Mailing List

21 Jul 2023, 04:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/ -

16 Jun 2023, 13:15

Type Values Removed Values Added
CWE CWE-74
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CPE cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
References (MISC) https://pkg.go.dev/vuln/GO-2023-1842 - (MISC) https://pkg.go.dev/vuln/GO-2023-1842 - Vendor Advisory
References (MISC) https://go.dev/issue/60306 - (MISC) https://go.dev/issue/60306 - Issue Tracking
References (MISC) https://go.dev/cl/501224 - (MISC) https://go.dev/cl/501224 - Patch
References (MISC) https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ - (MISC) https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ - Mailing List, Third Party Advisory

08 Jun 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-06-08 21:15

Updated : 2024-12-06 14:15

NVD link : CVE-2023-29405

Mitre link : CVE-2023-29405

CVE.ORG link : CVE-2023-29405

JSON object : View

Products Affected

golang

  • go

fedoraproject

  • fedora
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')