CVE-2020-28366

Published: Nov 18, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: NVD

Description

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

Affected (6)

Products: Golang: Go · Fedoraproject: Fedora · Netapp: Cloud Insights Telegraf Agent, Trident

1 product

1 product

2 products

Cloud Insights Telegraf Agent

Trident

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Golang Go	Before 1.14.12
Golang Go	From 1.15 to 1.15.5

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Insights Telegraf Agent	All versions
Netapp Trident	All versions

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (10)

https://go.dev/cl/269658

Source: security@golang.org

https://go.dev/issue/42559

Source: security@golang.org

https://go.googlesource.com/go/+/062e0e5ce6df339dc26732438ad771f73dbf2292

Source: security@golang.org

https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM

Source: security@golang.org

https://pkg.go.dev/vuln/GO-2022-0475

Source: security@golang.org

https://go.dev/cl/269658