{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-29402", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2023-04-05T19:36:35.042Z", "datePublished": "2023-06-08T20:19:04.483Z", "dateUpdated": "2024-12-13T13:09:24.218Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2023-06-12T19:08:33.331Z"}, "title": "Code injection via go command with cgo in cmd/go", "descriptions": [{"lang": "en", "value": "The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via \"go get\", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected)."}], "affected": [{"vendor": "Go toolchain", "product": "cmd/go", "collectionURL": "https://pkg.go.dev", "packageName": "cmd/go", "versions": [{"version": "0", "lessThan": "1.19.10", "status": "affected", "versionType": "semver"}, {"version": "1.20.0-0", "lessThan": "1.20.5", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "references": [{"url": "https://go.dev/issue/60167"}, {"url": "https://go.dev/cl/501226"}, {"url": "https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ"}, {"url": "https://pkg.go.dev/vuln/GO-2023-1839"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/"}, {"url": "https://security.gentoo.org/glsa/202311-09"}], "credits": [{"lang": "en", "value": "Juho Nurminen of Mattermost"}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://go.dev/issue/60167", "tags": ["x_transferred"]}, {"url": "https://go.dev/cl/501226", "tags": ["x_transferred"]}, {"url": "https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ", "tags": ["x_transferred"]}, {"url": "https://pkg.go.dev/vuln/GO-2023-1839", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/", "tags": ["x_transferred"]}, {"url": "https://security.gentoo.org/glsa/202311-09", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20241213-0004/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-12-13T13:09:24.218Z"}}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "E17A25CE-A8C9-4F89-916A-BB0327A509C9", "versionEndExcluding": "1.19.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "53EC811C-49DE-4470-908C-CDC9282EC7FA", "versionEndExcluding": "1.20.5", "versionStartIncluding": "1.20.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*", "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via \"go get\", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected)."}], "id": "CVE-2023-29402", "lastModified": "2024-12-13T14:15:20.403", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-06-08T21:15:16.770", "references": [{"source": "[email protected]", "tags": ["Patch"], "url": "https://go.dev/cl/501226"}, {"source": "[email protected]", "tags": ["Issue Tracking"], "url": "https://go.dev/issue/60167"}, {"source": "[email protected]", "tags": ["Mailing List", "Release Notes"], "url": "https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/"}, {"source": "[email protected]", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2023-1839"}, {"source": "[email protected]", "url": "https://security.gentoo.org/glsa/202311-09"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://go.dev/cl/501226"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking"], "url": "https://go.dev/issue/60167"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Release Notes"], "url": "https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2023-1839"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/202311-09"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20241213-0004/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "[email protected]", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:4119", "cpe": "cpe:/a:redhat:ceph_storage:5.3::el8", "package": "rhceph/keepalived-rhel8:2.1.5-42", "product_name": "Red Hat Ceph Storage 5.3", "release_date": "2024-06-26T00:00:00Z"}, {"advisory": "RHSA-2024:4119", "cpe": "cpe:/a:redhat:ceph_storage:5.3::el8", "package": "rhceph/rhceph-5-dashboard-rhel8:5-87", "product_name": "Red Hat Ceph Storage 5.3", "release_date": "2024-06-26T00:00:00Z"}, {"advisory": "RHSA-2024:4119", "cpe": "cpe:/a:redhat:ceph_storage:5.3::el8", "package": "rhceph/rhceph-5-rhel8:5-519", "product_name": "Red Hat Ceph Storage 5.3", "release_date": "2024-06-26T00:00:00Z"}, {"advisory": "RHSA-2024:4119", "cpe": "cpe:/a:redhat:ceph_storage:5.3::el8", "package": "rhceph/rhceph-haproxy-rhel8:2.2.19-35", "product_name": "Red Hat Ceph Storage 5.3", "release_date": "2024-06-26T00:00:00Z"}, {"advisory": "RHSA-2024:4119", "cpe": "cpe:/a:redhat:ceph_storage:5.3::el8", "package": "rhceph/snmp-notifier-rhel8:1.2.1-69", "product_name": "Red Hat Ceph Storage 5.3", "release_date": "2024-06-26T00:00:00Z"}, {"advisory": "RHSA-2023:3920", "cpe": "cpe:/a:redhat:devtools:2023::el7", "package": "go-toolset-1.19-0:1.19.10-1.el7_9", "product_name": "Red Hat Developer Tools", "release_date": "2023-06-29T00:00:00Z"}, {"advisory": "RHSA-2023:3920", "cpe": "cpe:/a:redhat:devtools:2023::el7", "package": "go-toolset-1.19-golang-0:1.19.10-1.el7_9", "product_name": "Red Hat Developer Tools", "release_date": "2023-06-29T00:00:00Z"}, {"advisory": "RHSA-2023:3922", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "go-toolset:rhel8-8080020230627164522.6b4b45d8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-06-29T00:00:00Z"}, {"advisory": "RHSA-2023:3923", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "golang-0:1.19.10-1.el9_2", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-06-29T00:00:00Z"}, {"advisory": "RHSA-2023:3923", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "go-toolset-0:1.19.10-1.el9_2", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-06-29T00:00:00Z"}], "bugzilla": {"description": "golang: cmd/go: go command may generate unexpected code at build time when using cgo", "id": "2217562", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2217562"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-94", "details": ["The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via \"go get\", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).", "A flaw was found in golang. The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program that uses cgo. This can occur when running an untrusted module that contains directories with newline characters in their names. Modules that are retrieved using the go command, for example, via \"go get\", are not affected. Modules retrieved using GOPATH-mode, for example, GO111MODULE=off may be affected."], "name": "CVE-2023-29402", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:3", "fix_state": "Affected", "package_name": "golang", "product_name": "Red Hat Ceph Storage 3"}, {"cpe": "cpe:/a:redhat:storage:3", "fix_state": "Affected", "package_name": "golang", "product_name": "Red Hat Storage 3"}, {"cpe": "cpe:/a:redhat:storage:3", "fix_state": "Affected", "package_name": "go-toolset-7-golang", "product_name": "Red Hat Storage 3"}], "public_date": "2023-06-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-29402\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-29402\nhttps://go.dev/cl/501226\nhttps://go.dev/issue/60167\nhttps://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ\nhttps://pkg.go.dev/vuln/GO-2023-1839"], "statement": "This vulnerability is only applicable to customer use of the go compiler and not any pre-compiled golang binaries shipped by Red Hat.", "threat_severity": "Moderate", "upstream_fix": "go 1.20.5, go 1.19.10"}