Vulnerability · Published Jul 2, 2024 · Assigned by Go
CVE-2023-24531Output of "go env" does not sanitize values in cmd/go
Critical 9.8
In plain English
A critical-severity security flaw in cmd/go from Go toolchain. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-1.19 | no fix listed | DEBIAN-CVE-2023-24531 |
| Go | toolchain | 1.21.0-0 | GO-2024-2962 |
| Ubuntu:22.04:LTS | golang-1.17 | 1.17.13-3ubuntu1.2 | USN-7061-1 |
| Ubuntu:22.04:LTS | golang-1.17 | 1.17.13-3ubuntu1.2 | UBUNTU-CVE-2023-24531 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1.2 | UBUNTU-CVE-2023-24531 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1.2 | USN-7109-1 |
| Ubuntu:22.04:LTS | golang-1.20 | no fix listed | UBUNTU-CVE-2023-24531 |
| Ubuntu:22.04:LTS | golang-1.21 | no fix listed | UBUNTU-CVE-2023-24531 |
| Ubuntu:24.04:LTS | golang-1.21 | no fix listed | UBUNTU-CVE-2023-24531 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go toolchain | cmd/go | 0 – before 1.21.0-0 |