Vulnerability · Published Jun 8, 2023 · Assigned by Go
CVE-2023-29402Code injection via go command with cgo in cmd/go
Critical 9.8
In plain English
A critical-severity security flaw in cmd/go from Go toolchain. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | delve | 1.9.1-1.module_el8.8.0+3471+a62632a0 | ALSA-2023:3922 |
| AlmaLinux:8 | go-toolset | 1.19.10-1.module_el8.8.0+3571+89db2ae0 | ALSA-2023:3922 |
| AlmaLinux:9 | go-toolset | 1.19.10-1.el9_2 | ALSA-2023:3923 |
| AlmaLinux:8 | golang | 1.19.10-1.module_el8.8.0+3571+89db2ae0 | ALSA-2023:3922 |
| AlmaLinux:9 | golang | 1.19.10-1.el9_2 | ALSA-2023:3923 |
| AlmaLinux:8 | golang-bin | 1.19.10-1.module_el8.8.0+3571+89db2ae0 | ALSA-2023:3922 |
| AlmaLinux:9 | golang-bin | 1.19.10-1.el9_2 | ALSA-2023:3923 |
| AlmaLinux:8 | golang-docs | 1.19.10-1.module_el8.8.0+3571+89db2ae0 | ALSA-2023:3922 |
| AlmaLinux:9 | golang-docs | 1.19.10-1.el9_2 | ALSA-2023:3923 |
| AlmaLinux:8 | golang-misc | 1.19.10-1.module_el8.8.0+3571+89db2ae0 | ALSA-2023:3922 |
| AlmaLinux:9 | golang-misc | 1.19.10-1.el9_2 | ALSA-2023:3923 |
| AlmaLinux:8 | golang-race | 1.19.10-1.module_el8.8.0+3571+89db2ae0 | ALSA-2023:3922 |
| AlmaLinux:9 | golang-race | 1.19.10-1.el9_2 | ALSA-2023:3923 |
| AlmaLinux:8 | golang-src | 1.19.10-1.module_el8.8.0+3571+89db2ae0 | ALSA-2023:3922 |
| AlmaLinux:9 | golang-src | 1.19.10-1.el9_2 | ALSA-2023:3923 |
| AlmaLinux:8 | golang-tests | 1.19.10-1.module_el8.8.0+3571+89db2ae0 | ALSA-2023:3922 |
| AlmaLinux:9 | golang-tests | 1.19.10-1.el9_2 | ALSA-2023:3923 |
| Alpine:v3.20 | go | 1.20.5-r0 | ALPINE-CVE-2023-29402 |
| Alpine:v3.21 | go | 1.20.5-r0 | ALPINE-CVE-2023-29402 |
| Alpine:v3.22 | go | 1.20.5-r0 | ALPINE-CVE-2023-29402 |
| Alpine:v3.23 | go | 1.20.5-r0 | ALPINE-CVE-2023-29402 |
| Alpine:v3.24 | go | 1.20.5-r0 | ALPINE-CVE-2023-29402 |
| Debian:12 | golang-1.19 | no fix listed | DEBIAN-CVE-2023-29402 |
| Go | toolchain | 1.19.10, 1.20.5 | GO-2023-1839 |
| Rocky Linux:9 | go-toolset | 0:1.19.10-1.el9_2 | RLSA-2023:3923 |
| Rocky Linux:9 | golang | 0:1.19.10-1.el9_2 | RLSA-2023:3923 |
| Ubuntu:22.04:LTS | golang-1.17 | 1.17.13-3ubuntu1.2 | USN-7061-1 |
| Ubuntu:22.04:LTS | golang-1.17 | 1.17.13-3ubuntu1.2 | UBUNTU-CVE-2023-29402 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1.2 | USN-7109-1 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1.2 | UBUNTU-CVE-2023-29402 |
| Ubuntu:22.04:LTS | golang-1.20 | no fix listed | UBUNTU-CVE-2023-29402 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go toolchain | cmd/go | 0 – before 1.19.101.20.0-0 – before 1.20.5 |
References
- https://go.dev/issue/60167
- https://go.dev/cl/501226
- https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
- https://pkg.go.dev/vuln/GO-2023-1839
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
- https://security.gentoo.org/glsa/202311-09
- https://security.netapp.com/advisory/ntap-20241213-0004/