CVE-2023-39320: falha em Go toolchain cmd/go
Arbitrary code execution via go.mod toolchain directive in cmd/go
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 1.8%
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.
Produtos afetados
Go toolchain · cmd/goCVEs relacionadas — Go toolchain cmd/go
No mesmo produto, das mais perigosas para as menos.
CVE-2020-28367—Arbitrary code execution via the go command with cgo in cmd/goEPSS 2.4%CVE-2020-28366—Arbitrary code execution in go command with cgo in cmd/go and cmd/cgoEPSS 2.3%CVE-2023-39323HIGHArbitrary code execution during build via line directives in cmd/goEPSS 1.9%CVE-2023-29404CRITICALImproper handling of non-optional LDFLAGS in go command with cgo in cmd/goEPSS 1.8%CVE-2023-29405CRITICALImproper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/goEPSS 1.7%CVE-2023-29402CRITICALCode injection via go command with cgo in cmd/goEPSS 1.7%