kritik
CVE-2023-29404
golang: cmd/go: go command may execute arbitrary code at build time when using cgo
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, AlmaLinux, Azure Linux, Bitnami, CBL-Mariner, Oracle, Photon OS, Rocky Linux. Daha düşük diyenler: Red Hat (yüksek), Amazon (yüksek), Ubuntu (düşük).
Açıklama
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alma 8 | go-toolset:rhel8::delve, go-toolset:rhel8::go-toolset, go-toolset:rhel8::golang ve 6 tane daha | 1.9.1-1.module_el8.8.0+3471+a62632a0 ve 1 tane daha |
| alma 9 | go-toolset, golang, golang-bin ve 5 tane daha | 1.19.10-1.el9_2 |
| Azure Linux 3.0 | golang | 0:1.22.7-2.azl3 |
| bitnami::Bitnami Vulnerability Database | golang | 1.19.10, 1.20.5 |
| CBL-Mariner 2.0 | golang, msft-golang | 0:1.21.6-1.cm2 ve 1 tane daha |
| Oracle Linux 8 | delve, go-toolset, golang ve 6 tane daha | 1.9.1-1.0.1.module+el8.8.0+20964+30a27755 ve 2 tane daha |
| Oracle Linux 9 | go-toolset, golang, golang-bin ve 5 tane daha | 1.19.10-1.0.1.el9_2 |
| Photon OS 3.0 | calico, go | 3.20.2-10.ph3 ve 1 tane daha |
| Photon OS 4.0 | calico, calico-cni, calico-felix ve 4 tane daha | 3.20.2-14.ph4 ve 2 tane daha |
| Photon OS 5.0 | calico, calico-cni, calico-felix ve 5 tane daha | 3.25.0-5.ph5 ve 3 tane daha |
| rocky 9 | go-toolset, golang, golang-bin ve 5 tane daha | 1.19.10-1.el9_2 |
| alpine 3.18 | go | 1.20.5-r0 |
42 kaynaktaki 136 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alma 8 | go-toolset:rhel8::delve | 1.9.1-1.module_el8.8.0+3471+a62632a0 |
| alma 8 | go-toolset:rhel8::go-toolset | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 8 | go-toolset:rhel8::golang | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 8 | go-toolset:rhel8::golang-bin | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 8 | go-toolset:rhel8::golang-docs | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 8 | go-toolset:rhel8::golang-misc | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 8 | go-toolset:rhel8::golang-race | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 8 | go-toolset:rhel8::golang-src | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 8 | go-toolset:rhel8::golang-tests | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| alma 9 | go-toolset | 1.19.10-1.el9_2 |
| alma 9 | golang | 1.19.10-1.el9_2 |
| alma 9 | golang-bin | 1.19.10-1.el9_2 |
| alma 9 | golang-docs | 1.19.10-1.el9_2 |
| alma 9 | golang-misc | 1.19.10-1.el9_2 |
| alma 9 | golang-race | 1.19.10-1.el9_2 |
| alma 9 | golang-src | 1.19.10-1.el9_2 |
| alma 9 | golang-tests | 1.19.10-1.el9_2 |
| Azure Linux 3.0 | golang | 0:1.22.7-2.azl3 |
| bitnami::Bitnami Vulnerability Database | golang | 1.19.10, 1.20.5 |
| CBL-Mariner 2.0 | golang | 0:1.21.6-1.cm2 |
| CBL-Mariner 2.0 | msft-golang | 0:1.19.10-1.cm2 |
| Oracle Linux 8 | delve | 1.9.1-1.0.1.module+el8.8.0+20964+30a27755 |
| Oracle Linux 8 | go-toolset | 1.19.10-1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 8 | golang | 1.19.10-1.0.1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 8 | golang-bin | 1.19.10-1.0.1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 8 | golang-docs | 1.19.10-1.0.1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 8 | golang-misc | 1.19.10-1.0.1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 8 | golang-race | 1.19.10-1.0.1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 8 | golang-src | 1.19.10-1.0.1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 8 | golang-tests | 1.19.10-1.0.1.module+el8.8.0+21109+b7104c00 |
| Oracle Linux 9 | go-toolset | 1.19.10-1.0.1.el9_2 |
| Oracle Linux 9 | golang | 1.19.10-1.0.1.el9_2 |
| Oracle Linux 9 | golang-bin | 1.19.10-1.0.1.el9_2 |
| Oracle Linux 9 | golang-docs | 1.19.10-1.0.1.el9_2 |
| Oracle Linux 9 | golang-misc | 1.19.10-1.0.1.el9_2 |
| Oracle Linux 9 | golang-race | 1.19.10-1.0.1.el9_2 |
| Oracle Linux 9 | golang-src | 1.19.10-1.0.1.el9_2 |
| Oracle Linux 9 | golang-tests | 1.19.10-1.0.1.el9_2 |
| Photon OS 3.0 | calico | 3.20.2-10.ph3 |
| Photon OS 3.0 | go | 1.20.5-1.ph3 |
| Photon OS 4.0 | calico | 3.20.2-14.ph4 |
| Photon OS 4.0 | calico-cni | 3.20.2-14.ph4 |
| Photon OS 4.0 | calico-felix | 3.20.2-14.ph4 |
| Photon OS 4.0 | calico-k8s-policy | 3.20.2-14.ph4 |
| Photon OS 4.0 | confd | 3.20.2-14.ph4 |
| Photon OS 4.0 | kubernetes-dashboard | 2.7.0-1.ph4 |
| Photon OS 4.0 | pmd-ng | 0.1-2.ph4 |
| Photon OS 5.0 | calico | 3.25.0-5.ph5 |
| Photon OS 5.0 | calico-cni | 3.25.0-5.ph5 |
| Photon OS 5.0 | calico-felix | 3.25.0-5.ph5 |
| Photon OS 5.0 | calico-k8s-policy | 3.25.0-5.ph5 |
| Photon OS 5.0 | confd | 3.25.0-5.ph5 |
| Photon OS 5.0 | go | 1.20.5-1.ph5 |
| Photon OS 5.0 | kubernetes-dashboard | 2.7.0-6.ph5 |
| Photon OS 5.0 | pmd-ng | 0.1-3.ph5 |
| rocky 9 | go-toolset | 1.19.10-1.el9_2 |
| rocky 9 | golang | 1.19.10-1.el9_2 |
| rocky 9 | golang-bin | 1.19.10-1.el9_2 |
| rocky 9 | golang-docs | 1.19.10-1.el9_2 |
| rocky 9 | golang-misc | 1.19.10-1.el9_2 |
| rocky 9 | golang-race | 1.19.10-1.el9_2 |
| rocky 9 | golang-src | 1.19.10-1.el9_2 |
| rocky 9 | golang-tests | 1.19.10-1.el9_2 |
| alpine 3.18 | go | 1.20.5-r0 |
| alpine 3.19 | go | 1.20.5-r0 |
| alpine 3.20 | go | 1.20.5-r0 |
| alpine 3.21 | go | 1.20.5-r0 |
| alpine 3.22 | go | 1.20.5-r0 |
| alpine 3.23 | go | 1.20.5-r0 |
| alpine 3.24 | go | 1.20.5-r0 |
| alpine edge | go | 1.20.5-r0 |
| amazon linux 1 | golang | 1.20.8-1.47.amzn1 |
| amazon linux 1 | golang-bin | 1.20.8-1.47.amzn1 |
| amazon linux 1 | golang-docs | 1.20.8-1.47.amzn1 |
| amazon linux 1 | golang-misc | 1.20.8-1.47.amzn1 |
| amazon linux 1 | golang-shared | 1.20.8-1.47.amzn1 |
| amazon linux 1 | golang-src | 1.20.8-1.47.amzn1 |
| amazon linux 1 | golang-tests | 1.20.8-1.47.amzn1 |
| amazon linux 2 | golang | 1.20.5-1.amzn2.0.2 |
| amazon linux 2 | golang-bin | 1.20.5-1.amzn2.0.2 |
| amazon linux 2 | golang-docs | 1.20.5-1.amzn2.0.2 |
| amazon linux 2 | golang-misc | 1.20.5-1.amzn2.0.2 |
| amazon linux 2 | golang-shared | 1.20.5-1.amzn2.0.2 |
| amazon linux 2 | golang-src | 1.20.5-1.amzn2.0.2 |
| amazon linux 2 | golang-tests | 1.20.5-1.amzn2.0.2 |
| amazon linux 2023 | golang | 1.20.5-1.amzn2023.0.2 |
| amazon linux 2023 | golang-bin | 1.20.5-1.amzn2023.0.2 |
| amazon linux 2023 | golang-docs | 1.20.5-1.amzn2023.0.2 |
| amazon linux 2023 | golang-misc | 1.20.5-1.amzn2023.0.2 |
| amazon linux 2023 | golang-shared | 1.20.5-1.amzn2023.0.2 |
| amazon linux 2023 | golang-src | 1.20.5-1.amzn2023.0.2 |
| amazon linux 2023 | golang-tests | 1.20.5-1.amzn2023.0.2 |
| chainguard | kind | 0.21.0-r0 |
| chainguard | kubeflow-katib | 0.19.0-r40 |
| chainguard | policy-controller | 0.7.0-r4 |
| debian 10 | golang-1.11 | düzeltme belirtilmemiş |
| debian 11 | golang-1.15 | düzeltme belirtilmemiş |
| debian 12 | golang-1.19 | düzeltme belirtilmemiş |
| echo | golang-1.19 | düzeltme belirtilmemiş |
| rapidfort amazon linux 2023 | golang | 1.20.5-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | golang-bin | 1.20.5-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | golang-docs | 1.20.5-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | golang-misc | 1.20.5-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | golang-shared | 1.20.5-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | golang-src | 1.20.5-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | golang-tests | 1.20.5-1.amzn2023.0.2 |
| rapidfort debian 12 | golang-1.19 | düzeltme belirtilmemiş |
| rapidfort debian 13 | golang-1.19 | düzeltme belirtilmemiş |
| rapidfort Oracle Linux 9 | go-toolset | 0:1.19.10-1.0.1.el9_2 |
| rapidfort Oracle Linux 9 | golang | 0:1.19.10-1.0.1.el9_2 |
| rapidfort Oracle Linux 9 | golang-bin | 0:1.19.10-1.0.1.el9_2 |
| rapidfort Oracle Linux 9 | golang-docs | 0:1.19.10-1.0.1.el9_2 |
| rapidfort Oracle Linux 9 | golang-misc | 0:1.19.10-1.0.1.el9_2 |
| rapidfort Oracle Linux 9 | golang-race | 0:1.19.10-1.0.1.el9_2 |
| rapidfort Oracle Linux 9 | golang-src | 0:1.19.10-1.0.1.el9_2 |
| rapidfort Oracle Linux 9 | golang-tests | 0:1.19.10-1.0.1.el9_2 |
| rapidfort ubuntu 20.04 | golang-1.17 | 0:1.17.13-3ubuntu1.2 |
| rapidfort ubuntu 22.04 | golang-1.17 | 0:1.17.13-3ubuntu1.2 |
| rapidfort ubuntu 24.04 | golang-1.17 | 0:1.17.13-3ubuntu1.2 |
| Red Hat | go-toolset-7-golang | düzeltme belirtilmemiş |
| Red Hat | golang | düzeltme belirtilmemiş |
| Red Hat | golang-bin | düzeltme belirtilmemiş |
| Red Hat | golang-docs | düzeltme belirtilmemiş |
| Red Hat | golang-misc | düzeltme belirtilmemiş |
| Red Hat | golang-src | düzeltme belirtilmemiş |
| Red Hat | golang-tests | düzeltme belirtilmemiş |
| root.io debian 12 | rootio-golang-1.19 | düzeltme belirtilmemiş |
| ubuntu 16.04-ESM | golang-1.18 | 1.18.1-1ubuntu1~16.04.6+esm1 |
| ubuntu 18.04-ESM | golang-1.18 | 1.18.1-1ubuntu1~18.04.4+esm1 |
| ubuntu 20.04 | golang-1.18 | 1.18.1-1ubuntu1~20.04.3 |
| ubuntu 20.04-ESM | golang-1.18 | 1.18.1-1ubuntu1~20.04.3 |
| ubuntu 22.04 | golang-1.17 | 1.17.13-3ubuntu1.2 |
| ubuntu 22.04 | golang-1.18 | 1.18.1-1ubuntu1.2 |
| wolfi | kind | 0.21.0-r0 |
| wolfi | kubeflow-katib | 0.19.0-r40 |
| wolfi | policy-controller | 0.7.0-r4 |
Referanslar
- https://access.redhat.com/errata/RHSA-2023:3923
- https://access.redhat.com/security/cve/CVE-2023-29404
- https://bugzilla.redhat.com/2216965
- https://bugzilla.redhat.com/2217562
- https://bugzilla.redhat.com/2217565
- https://bugzilla.redhat.com/2217569
- https://bugzilla.redhat.com/show_bug.cgi?id=2216965
- https://bugzilla.redhat.com/show_bug.cgi?id=2217562
35 referansın hepsi
- https://bugzilla.redhat.com/show_bug.cgi?id=2217565
- https://bugzilla.redhat.com/show_bug.cgi?id=2217569
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29402
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29403
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29404
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29405
- https://errata.almalinux.org/9/ALSA-2023-3923.html
- https://errata.rockylinux.org/RLSA-2023:3923
- https://github.com/golang/go/commit/356a419e2f811b65d227abcea1a346f8dcb154e0%20%28go1.20.5%29
- https://github.com/golang/go/commit/bf3c8ce03e175e870763901a3850bca01381a828%20%28go1.19.10%29
- https://github.com/golang/go/issues/60305
- https://go.dev/cl/501225
- https://go.dev/issue/60305
- https://groups.google.com/g/golang-announce/c/q5135a9d924
- https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
- https://linux.oracle.com/cve/CVE-2023-29404.html
- https://linux.oracle.com/errata/ELSA-2023-3923.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/
- https://nvd.nist.gov/vuln/detail/CVE-2023-29404
- https://pkg.go.dev/vuln/GO-2023-1841
- https://security.gentoo.org/glsa/202311-09
- https://security.netapp.com/advisory/ntap-20241115-0009/
- https://ubuntu.com/security/notices/USN-7061-1
- https://ubuntu.com/security/notices/USN-7109-1
- https://www.cve.org/CVERecord?id=CVE-2023-29404