CVE-2020-28366

Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

State: Published
Severity: Not scored
Published: Nov 18, 2020
Updated: Aug 4, 2024
Reserved: Nov 9, 2020

Description

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
cmd/goGo toolchain	before 1.14.12Affected 1.15.0-0 to before 1.15.5Affected
cmd/cgoGo toolchain	before 1.14.12Affected 1.15.0-0 to before 1.15.5Affected

References

https://go.dev/cl/269658
https://go.googlesource.com/go/+/062e0e5ce6df339dc26732438ad771f73dbf2292
https://go.dev/issue/42559
https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM
https://pkg.go.dev/vuln/GO-2022-0475

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.