critique
CVE-2023-29402
golang: cmd/go: go command may generate unexpected code at build time when using cgo
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.0CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, AlmaLinux, Azure Linux, Bitnami, CBL-Mariner, Oracle, Photon OS, Rocky Linux. Plus basse selon Amazon (élevée), Red Hat (moyenne), Ubuntu (faible).
Description
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alma 8 | go-toolset:rhel8::delve, go-toolset:rhel8::go-toolset, go-toolset:rhel8::golang et 6 autres | 1.9.1-1.module_el8.8.0+3471+a62632a0 et 1 autres |
| alma 9 | go-toolset, golang, golang-bin et 5 autres | 1.19.10-1.el9_2 |
| Azure Linux 3.0 | golang | 0:1.22.7-2.azl3 |
| bitnami::Bitnami Vulnerability Database | golang | 1.19.10, 1.20.5 |
| CBL-Mariner 2.0 | golang, msft-golang | 0:1.21.6-1.cm2 et 1 autres |
| Oracle Linux 8 | delve, go-toolset, golang et 6 autres | 1.9.1-1.0.1.module+el8.8.0+20964+30a27755 et 2 autres |
| Oracle Linux 9 | go-toolset, golang, golang-bin et 5 autres | 1.19.10-1.0.1.el9_2 |
| Photon OS 3.0 | calico, go | 3.20.2-10.ph3 et 1 autres |
| Photon OS 4.0 | calico, calico-cni, calico-felix et 4 autres | 3.20.2-14.ph4 et 2 autres |
| Photon OS 5.0 | calico, calico-cni, calico-felix et 5 autres | 3.25.0-5.ph5 et 3 autres |
| rocky 9 | go-toolset, golang, golang-bin et 5 autres | 1.19.10-1.el9_2 |
| alpine 3.18 | go | 1.20.5-r0 |
Afficher les 138 entrées de 42 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alma 8 | go-toolset:rhel8::delve | 1.9.1-1.module_el8.8.0+3471+a62632a0 |
| alma 8 | go-toolset:rhel8::go-toolset | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 8 | go-toolset:rhel8::golang | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 8 | go-toolset:rhel8::golang-bin | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 8 | go-toolset:rhel8::golang-docs | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 8 | go-toolset:rhel8::golang-misc | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 8 | go-toolset:rhel8::golang-race | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 8 | go-toolset:rhel8::golang-src | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 8 | go-toolset:rhel8::golang-tests | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 9 | go-toolset | 1.19.10-1.el9_2 |
| alma 9 | golang | 1.19.10-1.el9_2 |
| alma 9 | golang-bin | 1.19.10-1.el9_2 |
| alma 9 | golang-docs | 1.19.10-1.el9_2 |
| alma 9 | golang-misc | 1.19.10-1.el9_2 |
| alma 9 | golang-race | 1.19.10-1.el9_2 |
| alma 9 | golang-src | 1.19.10-1.el9_2 |
| alma 9 | golang-tests | 1.19.10-1.el9_2 |
| Azure Linux 3.0 | golang | 0:1.22.7-2.azl3 |
| bitnami::Bitnami Vulnerability Database | golang | 1.19.10, 1.20.5 |
| CBL-Mariner 2.0 | golang | 0:1.21.6-1.cm2 |
| CBL-Mariner 2.0 | msft-golang | 0:1.19.10-1.cm2 |
| Oracle Linux 8 | delve | 1.9.1-1.0.1.module+el8.8.0+20964+30a27755 |
| Oracle Linux 8 | go-toolset | 1.19.10-1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 8 | golang | 1.19.10-1.0.1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 8 | golang-bin | 1.19.10-1.0.1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 8 | golang-docs | 1.19.10-1.0.1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 8 | golang-misc | 1.19.10-1.0.1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 8 | golang-race | 1.19.10-1.0.1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 8 | golang-src | 1.19.10-1.0.1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 8 | golang-tests | 1.19.10-1.0.1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 9 | go-toolset | 1.19.10-1.0.1.el9_2 |
| Oracle Linux 9 | golang | 1.19.10-1.0.1.el9_2 |
| Oracle Linux 9 | golang-bin | 1.19.10-1.0.1.el9_2 |
| Oracle Linux 9 | golang-docs | 1.19.10-1.0.1.el9_2 |
| Oracle Linux 9 | golang-misc | 1.19.10-1.0.1.el9_2 |
| Oracle Linux 9 | golang-race | 1.19.10-1.0.1.el9_2 |
| Oracle Linux 9 | golang-src | 1.19.10-1.0.1.el9_2 |
| Oracle Linux 9 | golang-tests | 1.19.10-1.0.1.el9_2 |
| Photon OS 3.0 | calico | 3.20.2-10.ph3 |
| Photon OS 3.0 | go | 1.20.5-1.ph3 |
| Photon OS 4.0 | calico | 3.20.2-14.ph4 |
| Photon OS 4.0 | calico-cni | 3.20.2-14.ph4 |
| Photon OS 4.0 | calico-felix | 3.20.2-14.ph4 |
| Photon OS 4.0 | calico-k8s-policy | 3.20.2-14.ph4 |
| Photon OS 4.0 | confd | 3.20.2-14.ph4 |
| Photon OS 4.0 | kubernetes-dashboard | 2.7.0-1.ph4 |
| Photon OS 4.0 | pmd-ng | 0.1-2.ph4 |
| Photon OS 5.0 | calico | 3.25.0-5.ph5 |
| Photon OS 5.0 | calico-cni | 3.25.0-5.ph5 |
| Photon OS 5.0 | calico-felix | 3.25.0-5.ph5 |
| Photon OS 5.0 | calico-k8s-policy | 3.25.0-5.ph5 |
| Photon OS 5.0 | confd | 3.25.0-5.ph5 |
| Photon OS 5.0 | go | 1.20.5-1.ph5 |
| Photon OS 5.0 | kubernetes-dashboard | 2.7.0-6.ph5 |
| Photon OS 5.0 | pmd-ng | 0.1-3.ph5 |
| rocky 9 | go-toolset | 1.19.10-1.el9_2 |
| rocky 9 | golang | 1.19.10-1.el9_2 |
| rocky 9 | golang-bin | 1.19.10-1.el9_2 |
| rocky 9 | golang-docs | 1.19.10-1.el9_2 |
| rocky 9 | golang-misc | 1.19.10-1.el9_2 |
| rocky 9 | golang-race | 1.19.10-1.el9_2 |
| rocky 9 | golang-src | 1.19.10-1.el9_2 |
| rocky 9 | golang-tests | 1.19.10-1.el9_2 |
| alpine 3.18 | go | 1.20.5-r0 |
| alpine 3.19 | go | 1.20.5-r0 |
| alpine 3.20 | go | 1.20.5-r0 |
| alpine 3.21 | go | 1.20.5-r0 |
| alpine 3.22 | go | 1.20.5-r0 |
| alpine 3.23 | go | 1.20.5-r0 |
| alpine 3.24 | go | 1.20.5-r0 |
| alpine edge | go | 1.20.5-r0 |
| amazon linux 1 | golang | 1.18.6-1.45.amzn1 |
| amazon linux 1 | golang-bin | 1.18.6-1.45.amzn1 |
| amazon linux 1 | golang-docs | 1.18.6-1.45.amzn1 |
| amazon linux 1 | golang-misc | 1.18.6-1.45.amzn1 |
| amazon linux 1 | golang-race | 1.18.6-1.45.amzn1 |
| amazon linux 1 | golang-shared | 1.18.6-1.45.amzn1 |
| amazon linux 1 | golang-src | 1.18.6-1.45.amzn1 |
| amazon linux 1 | golang-tests | 1.18.6-1.45.amzn1 |
| amazon linux 2 | golang | 1.18.9-1.amzn2.0.6 |
| amazon linux 2 | golang-bin | 1.18.9-1.amzn2.0.6 |
| amazon linux 2 | golang-docs | 1.18.9-1.amzn2.0.6 |
| amazon linux 2 | golang-misc | 1.18.9-1.amzn2.0.6 |
| amazon linux 2 | golang-race | 1.18.9-1.amzn2.0.6 |
| amazon linux 2 | golang-shared | 1.18.9-1.amzn2.0.6 |
| amazon linux 2 | golang-src | 1.18.9-1.amzn2.0.6 |
| amazon linux 2 | golang-tests | 1.18.9-1.amzn2.0.6 |
| amazon linux 2023 | golang | 1.20.5-1.amzn2023.0.2 |
| amazon linux 2023 | golang-bin | 1.20.5-1.amzn2023.0.2 |
| amazon linux 2023 | golang-docs | 1.20.5-1.amzn2023.0.2 |
| amazon linux 2023 | golang-misc | 1.20.5-1.amzn2023.0.2 |
| amazon linux 2023 | golang-shared | 1.20.5-1.amzn2023.0.2 |
| amazon linux 2023 | golang-src | 1.20.5-1.amzn2023.0.2 |
| amazon linux 2023 | golang-tests | 1.20.5-1.amzn2023.0.2 |
| chainguard | kind | 0.21.0-r0 |
| chainguard | kubeflow-katib | 0.19.0-r40 |
| chainguard | policy-controller | 0.7.0-r4 |
| debian 10 | golang-1.11 | pas de correctif indiqué |
| debian 11 | golang-1.15 | pas de correctif indiqué |
| debian 12 | golang-1.19 | pas de correctif indiqué |
| echo | golang-1.19 | pas de correctif indiqué |
| rapidfort amazon linux 2023 | golang | 1.20.5-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | golang-bin | 1.20.5-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | golang-docs | 1.20.5-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | golang-misc | 1.20.5-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | golang-shared | 1.20.5-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | golang-src | 1.20.5-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | golang-tests | 1.20.5-1.amzn2023.0.2 |
| rapidfort debian 12 | golang-1.19 | pas de correctif indiqué |
| rapidfort debian 13 | golang-1.19 | pas de correctif indiqué |
| rapidfort Oracle Linux 9 | go-toolset | 0:1.19.10-1.0.1.el9_2 |
| rapidfort Oracle Linux 9 | golang | 0:1.19.10-1.0.1.el9_2 |
| rapidfort Oracle Linux 9 | golang-bin | 0:1.19.10-1.0.1.el9_2 |
| rapidfort Oracle Linux 9 | golang-docs | 0:1.19.10-1.0.1.el9_2 |
| rapidfort Oracle Linux 9 | golang-misc | 0:1.19.10-1.0.1.el9_2 |
| rapidfort Oracle Linux 9 | golang-race | 0:1.19.10-1.0.1.el9_2 |
| rapidfort Oracle Linux 9 | golang-src | 0:1.19.10-1.0.1.el9_2 |
| rapidfort Oracle Linux 9 | golang-tests | 0:1.19.10-1.0.1.el9_2 |
| rapidfort ubuntu 20.04 | golang-1.17 | 0:1.17.13-3ubuntu1.2 |
| rapidfort ubuntu 22.04 | golang-1.17 | 0:1.17.13-3ubuntu1.2 |
| rapidfort ubuntu 24.04 | golang-1.17 | 0:1.17.13-3ubuntu1.2 |
| Red Hat | go-toolset-7-golang | pas de correctif indiqué |
| Red Hat | golang | pas de correctif indiqué |
| Red Hat | golang-bin | pas de correctif indiqué |
| Red Hat | golang-docs | pas de correctif indiqué |
| Red Hat | golang-misc | pas de correctif indiqué |
| Red Hat | golang-src | pas de correctif indiqué |
| Red Hat | golang-tests | pas de correctif indiqué |
| root.io debian 12 | rootio-golang-1.19 | pas de correctif indiqué |
| ubuntu 16.04-ESM | golang-1.18 | 1.18.1-1ubuntu1~16.04.6+esm1 |
| ubuntu 18.04-ESM | golang-1.18 | 1.18.1-1ubuntu1~18.04.4+esm1 |
| ubuntu 20.04 | golang-1.18 | 1.18.1-1ubuntu1~20.04.3 |
| ubuntu 20.04-ESM | golang-1.18 | 1.18.1-1ubuntu1~20.04.3 |
| ubuntu 22.04 | golang-1.17 | 1.17.13-3ubuntu1.2 |
| ubuntu 22.04 | golang-1.18 | 1.18.1-1ubuntu1.2 |
| wolfi | kind | 0.21.0-r0 |
| wolfi | kubeflow-katib | 0.19.0-r40 |
| wolfi | policy-controller | 0.7.0-r4 |
Références
- https://access.redhat.com/errata/RHSA-2023:3923
- https://access.redhat.com/security/cve/CVE-2023-29402
- https://bugzilla.redhat.com/2216965
- https://bugzilla.redhat.com/2217562
- https://bugzilla.redhat.com/2217565
- https://bugzilla.redhat.com/2217569
- https://bugzilla.redhat.com/show_bug.cgi?id=2216965
- https://bugzilla.redhat.com/show_bug.cgi?id=2217562
Les 35 références
- https://bugzilla.redhat.com/show_bug.cgi?id=2217565
- https://bugzilla.redhat.com/show_bug.cgi?id=2217569
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29402
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29403
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29404
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29405
- https://errata.almalinux.org/9/ALSA-2023-3923.html
- https://errata.rockylinux.org/RLSA-2023:3923
- https://github.com/golang/go/commit/c0ed873cd8259f16d0da67eee783fda49f45ef61%20%28go1.20.5%29
- https://github.com/golang/go/commit/c160b49b6d328c86bd76ca2fff9009a71347333f%20%28go.1.19.10%29
- https://github.com/golang/go/issues/60167
- https://go.dev/cl/501226
- https://go.dev/issue/60167
- https://groups.google.com/g/golang-announce/c/q5135a9d924
- https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
- https://linux.oracle.com/cve/CVE-2023-29402.html
- https://linux.oracle.com/errata/ELSA-2023-3923.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/
- https://nvd.nist.gov/vuln/detail/CVE-2023-29402
- https://pkg.go.dev/vuln/GO-2023-1839
- https://security.gentoo.org/glsa/202311-09
- https://security.netapp.com/advisory/ntap-20241213-0004/
- https://ubuntu.com/security/notices/USN-7061-1
- https://ubuntu.com/security/notices/USN-7109-1
- https://www.cve.org/CVERecord?id=CVE-2023-29402