← Back

CVE-2023-29402

nvd nist
Published: Jun 8, 2023Modified: Jan 6, 2025

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).

Affected (3)

Products: Golang: Go · Fedoraproject: Fedora
1 product
Go
1 product
Fedora
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Golang
Before 1.19.10
From 1.20.0 to 1.20.5
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Version 38

References (15)

Source: security@golang.org
Patch
Source: security@golang.org
Issue Tracking
Source: security@golang.org
Mailing ListRelease Notes
Source: security@golang.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListRelease Notes
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.