CVE-2020-28366

CVE-2020-28366: falha em Go toolchain cmd/go

Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar cmd/go+ Monitorar cmd/cgo

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 2.3%
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
Produtos afetados
Go toolchain · cmd/cgoGo toolchain · cmd/go
CVEs relacionadas — Go toolchain cmd/go

No mesmo produto, das mais perigosas para as menos.

CVE-2020-28367—Arbitrary code execution via the go command with cgo in cmd/goEPSS 2.4%CVE-2023-39323HIGHArbitrary code execution during build via line directives in cmd/goEPSS 1.9%CVE-2023-29404CRITICALImproper handling of non-optional LDFLAGS in go command with cgo in cmd/goEPSS 1.8%CVE-2023-39320—Arbitrary code execution via go.mod toolchain directive in cmd/goEPSS 1.8%CVE-2023-29405CRITICALImproper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/goEPSS 1.7%CVE-2023-29402CRITICALCode injection via go command with cgo in cmd/goEPSS 1.7%