CVE-2020-28367

Arbitrary code execution via the go command with cgo in cmd/go

State: Published
Severity: Not scored
Published: Nov 18, 2020
Updated: Aug 4, 2024
Reserved: Nov 9, 2020

Description

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
cmd/goGo toolchain	before 1.14.12Affected 1.15.0-0 to before 1.15.5Affected

References

https://go.dev/cl/267277
https://go.googlesource.com/go/+/da7aa86917811a571e6634b45a457f918b8e6561
https://go.dev/issue/42556
https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM
https://pkg.go.dev/vuln/GO-2022-0476
https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.