{"id":"CVE-2020-28366","aliases":["ALPINE-CVE-2020-28366","AZL-38452","BELL-CVE-2020-28366","BIT-golang-2020-28366","DEBIAN-CVE-2020-28366","EUVD-2020-20825","GHSA-mwfg-6wv9-379f","GO-2022-0475","MGASA-2021-0018","RHSA-2020:5333","RHSA-2020:5493","RHSA-2021:0145","SUSE-SU-2020:3368-1","SUSE-SU-2020:3369-1","UBUNTU-CVE-2020-28366","openSUSE-SU-2020:2047-1","openSUSE-SU-2020:2067-1","openSUSE-SU-2020:2139-1","openSUSE-SU-2024:10807-1","openSUSE-SU-2024:10808-1"],"status":"published","title":"Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo","description":"Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02342,"percentile":0.83746,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2020-11-18T00:00:00Z","modified":"2026-11-03T06:32:25Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"go","fixed_in":["1.15.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"go","fixed_in":["1.15.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"go","fixed_in":["1.15.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"go","fixed_in":["1.15.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"go","fixed_in":["1.15.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"go","fixed_in":["1.15.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"go","fixed_in":["1.15.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"go","fixed_in":["1.15.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"go","fixed_in":["1.15.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"go","fixed_in":["1.15.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"go","fixed_in":["1.15.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.15.5-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-tensorboard","fixed_in":["2.16.2-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.14.12","1.15.5"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"golang-1.15","fixed_in":["1.15.5-1"],"sources":["osv"]},{"ecosystem":"Go","package":"toolchain","fixed_in":["1.14.12","1.15.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.5-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tensorboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.2-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.14.12"},{"introduced":"1.15.0"},{"fixed":"1.15.5"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"golang-1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.5-1"}]}]},{"source":"osv","ecosystem":"Go","package":"toolchain","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.14.12"},{"introduced":"1.15.0-0"},{"fixed":"1.15.5"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.15-3.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2020","package":"go-toolset-1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2020","package":"go-toolset-1.14-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2020","package":"go-toolset-1.14-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2020","package":"go-toolset-1.14-golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2020","package":"go-toolset-1.14-golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2020","package":"go-toolset-1.14-golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2020","package":"go-toolset-1.14-golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2020","package":"go-toolset-1.14-golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2020","package":"go-toolset-1.14-golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2020","package":"go-toolset-1.14-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-1.module+el8.3.0+7840+63dfb1ed"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-1.module+el8.3.0+7840+63dfb1ed"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-1.module+el8.3.0+7840+63dfb1ed"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.module+el8.3.0+8784+380394dc"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.module+el8.3.0+8784+380394dc"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.module+el8.3.0+8784+380394dc"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.module+el8.3.0+8784+380394dc"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.module+el8.3.0+8784+380394dc"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.module+el8.3.0+8784+380394dc"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.module+el8.3.0+8784+380394dc"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.12-1.module+el8.3.0+8784+380394dc"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:serverless:1.0::el8","package":"openshift-serverless-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.18.4-2.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP1","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.5-1.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.5-1.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP1","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.12-1.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.12-1.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~16.04.2","1.13.8-1ubuntu1~16.04.3","1.13.8-1ubuntu1~16.04.3+esm2","1.13.8-1ubuntu1~16.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10~rc1-1","1.10~rc1-1ubuntu1","1.10~rc1-2ubuntu1","1.10~rc2-1ubuntu1","1.10-1ubuntu1","1.10.1-1ubuntu2","1.10.4-2ubuntu1~18.04.1","1.10.4-2ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~18.04.2","1.13.8-1ubuntu1~18.04.3","1.13.8-1ubuntu1~18.04.4","1.13.8-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.1-1ubuntu1","1.13.3-1ubuntu1","1.13.4-1ubuntu1","1.13.5-1ubuntu1","1.13.6-1ubuntu1","1.13.6-2ubuntu1","1.13.7-1ubuntu1","1.13.8-1ubuntu1","1.13.8-1ubuntu1.1","1.13.8-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14~beta1-1","1.14~beta1-2","1.14~rc1-1","1.14-1","1.14.1-1","1.14.2-1","1.14.2-1ubuntu1","1.14.3-2ubuntu2~20.04.1","1.14.3-2ubuntu2~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu2","1.13.8-1ubuntu2.22.04.1","1.13.8-1ubuntu2.22.04.1+esm1","1.13.8-1ubuntu2.22.04.2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.12-lp151.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.12-lp152.2.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.5-lp152.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.15-1.6"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.15-1.2"}]}],"bundled":14}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"go toolchain","product":"cmd/cgo"},{"vendor":"go toolchain","product":"cmd/go"},{"vendor":"golang","product":"go"},{"vendor":"netapp","product":"cloud_insights_telegraf_agent"},{"vendor":"netapp","product":"trident"}],"references":[{"url":"https://go.dev/cl/269658","tags":["x_transferred","web","fix"]},{"url":"https://go.googlesource.com/go/+/062e0e5ce6df339dc26732438ad771f73dbf2292","tags":["x_transferred","web","fix"]},{"url":"https://go.dev/issue/42559","tags":["x_transferred","web","report"]},{"url":"https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM","tags":["x_transferred","web"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0475","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28366","tags":["web","advisory"]},{"url":"https://github.com/golang/go/issues/42559"},{"url":"https://lists.apache.org/thread.html/rd02e75766cd333a0df417588460f5e4477060633000bfe94955851fd@%3Cissues.trafficcontrol.apache.org%3E"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2W4COUPL3YVTZ6RTEIT6LPBDJUFF3VSP/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F3ZSHGNTJWCWYAKY5OLZS2XQQYHSXSUO/"},{"url":"https://security.netapp.com/advisory/ntap-20201202-0004/"},{"url":"https://security.gentoo.org/glsa/202208-02"},{"url":"https://github.com/advisories/GHSA-mwfg-6wv9-379f"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-28366","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-28366","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-28366","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0018.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27650","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/F3ZSHGNTJWCWYAKY5OLZS2XQQYHSXSUO/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5333","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_go_1.14.7_toolset","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1897635","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1897643","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1897646","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5333.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28362","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28362","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28362","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28366","tags":["advisory","report"]},{"url":"https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM/m/fLguyiM2CAAJ","tags":["article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28367","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28367","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28367","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5493","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_go_1.14.10_toolset","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1874857","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5493.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-24553","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-24553","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-24553","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/golang-announce/8wqlSbkLdPs","tags":["article"]},{"url":"https://www.redteam-pentesting.de/en/advisories/rt-sa-2020-004/-inconsistent-behavior-of-gos-cgi-and-fastcgi-transport-may-lead-to-cross-site-scripting","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0145","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless_applications/installing-openshift-serverless-1#installing-kn","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1906386","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0145.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203368-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1175132","tags":["report"]},{"url":"https://bugzilla.suse.com/1178750","tags":["report"]},{"url":"https://bugzilla.suse.com/1178752","tags":["report"]},{"url":"https://bugzilla.suse.com/1178753","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28367","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203369-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1164903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-28366","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/E2QCSRQATMLK7WM4IWLILC7IQJFW7PVI/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IQVUQXAVUQCNNOSHNTQGRCAEYALRL2NA/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5HGUG34M7TVN5CJXWIHJF454FAT7TTWY/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36221","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-28366","title":"Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo","description":"Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.","status":"published","published":"2020-11-18T00:00:00Z","modified":"2024-08-04T16:33:58.955Z","updated_at":"2026-11-02T14:35:57.017407Z"}],"euvd":[{"id":"EUVD-2020-20825","description":"Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.","status":"published","published":"2020-11-18T00:00:00Z","modified":"2024-08-04T16:33:58Z","updated_at":"2026-11-03T03:07:10.123634Z"}],"ghsa":[{"id":"GHSA-mwfg-6wv9-379f","title":"Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection.","description":"Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection.","status":"published","published":"2022-05-24T17:34:32Z","modified":"2023-01-29T05:04:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:45:37.901426Z"}],"nvd":[{"id":"CVE-2020-28366","description":"Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.","status":"published","published":"2020-11-18T17:15:11.993Z","modified":"2026-06-17T03:10:20.247Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:06:25.394006Z"}],"osv":[{"id":"ALPINE-CVE-2020-28366","description":"Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.","status":"published","published":"2020-11-18T17:15:11.993Z","modified":"2026-11-03T06:32:25.538963685Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"AZL-38452","title":"CVE-2020-28366 affecting package python-tensorboard for versions less than 2.16.2-1","description":"Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.","status":"published","published":"2020-11-18T17:15:11Z","modified":"2026-04-21T04:56:29.189689Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"BELL-CVE-2020-28366","title":"CVE-2020-28366 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:49.320183Z","modified":"2026-01-26T09:50:04.437482Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-28366","description":"Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.","status":"published","published":"2020-11-18T17:15:11.993Z","modified":"2026-10-24T10:30:36.368954964Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"DEBIAN-CVE-2020-28366","description":"Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.","status":"published","published":"2020-11-18T17:15:11.993Z","modified":"2026-08-27T13:03:12.00841047Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"RHSA-2020:5333","title":"Red Hat Security Advisory: go-toolset-1.14-golang security update","status":"published","published":"2024-09-18T04:15:40Z","modified":"2026-10-13T10:01:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:5493","title":"Red Hat Security Advisory: go-toolset:rhel8 security update","status":"published","published":"2024-09-18T04:16:09Z","modified":"2026-10-13T10:01:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2021:0145","title":"Red Hat Security Advisory: Red Hat OpenShift Serverless Client kn 1.12.0","status":"published","published":"2024-09-18T04:16:08Z","modified":"2026-10-13T10:02:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"UBUNTU-CVE-2020-28366","description":"Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.","status":"published","published":"2020-11-18T17:15:00Z","modified":"2025-10-24T04:48:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"BIT-golang-2020-28366","title":"Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo","description":"Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.","status":"published","published":"2024-03-06T11:07:42.467Z","modified":"2025-05-20T10:02:07.006Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"GO-2022-0475","title":"Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo","description":"The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code.\n\nThis can be caused by malicious unquoted symbol name in a linked object file.","status":"published","published":"2022-07-28T17:24:30Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"},{"id":"MGASA-2021-0018","title":"Updated golang packages fix security vulnerabilities","description":"An input validation vulnerability was found in go. From a generated go file\n(from the cgo tool) it is possible to modify symbols within that object file\nand specify code instead. An attacker could potentially use this flaw by\ncreating a repository which included malicious pre-built object files that\ncould execute arbitrary code when downloaded and run via \"go get\" or \"go build\"\nwhilst building a go project (CVE-2020-28366).\n\nAn input validation vulnerability was found in go. If cgo is specified in a go\nfile, it is possible to bypass the validation of arguments to the gcc compiler.\nAn attacker could potentially use this flaw by creating a malicious repository\nwhich would execute arbitrary code when downloaded and run via \"go get\" or \n\"go build\" whilst building a go project (CVE-2020-28367).\n","status":"published","published":"2021-01-10T19:46:12Z","modified":"2026-04-16T04:41:23.115371868Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:2047-1","title":"Security update for go1.14","description":"This update for go1.14 fixes the following issues:\n\n- go1.14.12 (released 2020-11-12) includes security fixes to the cmd/go and math/big packages.\n  * go#42553 math/big: panic during recursive division of very large numbers (bsc#1178750 CVE-2020-28362)\n  * go#42560 cmd/go: arbitrary code can be injected into cgo generated files (bsc#1178752 CVE-2020-28367)\n  * go#42557 cmd/go: improper validation of cgo flags can lead to remote code execution at build time (bsc#1178753 CVE-2020-28366)\n  * go#42155 time: Location interprets wrong timezone (DST) with slim zoneinfo\n  * go#42112 x/net/http2: the first write error on a connection will cause all subsequent write requests to fail blindly\n  * go#41991 runtime: macOS-only segfault on 1.14+ with 'split stack overflow'\n  * go#41913 net/http: request.Clone doesn't deep copy TransferEncoding\n  * go#41703 runtime: macOS syscall.Exec can get SIGILL due to preemption signal\n  * go#41386 x/net/http2: connection-level flow control not returned if stream errors, causes server hang\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-11-26T17:27:02Z","modified":"2026-02-04T03:29:29.981031Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:2067-1","title":"Security update for go1.14","description":"This update for go1.14 fixes the following issues:\n\n- go1.14.12 (released 2020-11-12) includes security fixes to the cmd/go and math/big packages.\n  * go#42553 math/big: panic during recursive division of very large numbers (bsc#1178750 CVE-2020-28362)\n  * go#42560 cmd/go: arbitrary code can be injected into cgo generated files (bsc#1178752 CVE-2020-28367)\n  * go#42557 cmd/go: improper validation of cgo flags can lead to remote code execution at build time (bsc#1178753 CVE-2020-28366)\n  * go#42155 time: Location interprets wrong timezone (DST) with slim zoneinfo\n  * go#42112 x/net/http2: the first write error on a connection will cause all subsequent write requests to fail blindly\n  * go#41991 runtime: macOS-only segfault on 1.14+ with 'split stack overflow'\n  * go#41913 net/http: request.Clone doesn't deep copy TransferEncoding\n  * go#41703 runtime: macOS syscall.Exec can get SIGILL due to preemption signal\n  * go#41386 x/net/http2: connection-level flow control not returned if stream errors, causes server hang\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-11-27T05:24:15Z","modified":"2026-02-04T04:06:01.090533Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:2139-1","title":"Security update for go1.15","description":"This update for go1.15 fixes the following issues:\n\n- go1.15.5 (released 2020-11-12) includes security fixes to the cmd/go and math/big packages.\n  * go#42553 math/big: panic during recursive division of very large numbers (bsc#1178750 CVE-2020-28362)\n  * go#42560 cmd/go: arbitrary code can be injected into cgo generated files (bsc#1178752 CVE-2020-28367)\n  * go#42557 cmd/go: improper validation of cgo flags can lead to remote code execution at build time (bsc#1178753 CVE-2020-28366)\n  * go#42169 cmd/compile, runtime, reflect: pointers to go:notinheap types must be stored indirectly in interfaces\n  * go#42151 cmd/cgo: opaque struct pointers are broken since Go 1.15.3\n  * go#42138 time: Location interprets wrong timezone (DST) with slim zoneinfo\n  * go#42113 x/net/http2: the first write error on a connection will cause all subsequent write requests to fail blindly\n  * go#41914 net/http: request.Clone doesn't deep copy TransferEncoding\n  * go#41704 runtime: macOS syscall.Exec can get SIGILL due to preemption signal\n  * go#41463 compress/flate: deflatefast produces corrupted output\n  * go#41387 x/net/http2: connection-level flow control not returned if stream errors, causes server hang\n  * go#40974 cmd/link: sectionForAddress(0xA9D67F) address not in any section file\n","status":"published","published":"2020-12-01T11:24:50Z","modified":"2025-05-07T18:12:02.175654Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:10807-1","title":"go1.14-1.14.15-1.6 on GA media","description":"These are all security issues fixed in the go1.14-1.14.15-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:32:42.416924Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10808-1","title":"go1.15-1.15.15-1.2 on GA media","description":"These are all security issues fixed in the go1.15-1.15.15-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:46:55.765323Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:3368-1","title":"Security update for go1.15","description":"This update for go1.15 fixes the following issues:\n\n- go1.15.5 (released 2020-11-12) includes security fixes to the cmd/go and math/big packages.\n  * go#42553 math/big: panic during recursive division of very large numbers (bsc#1178750 CVE-2020-28362)\n  * go#42560 cmd/go: arbitrary code can be injected into cgo generated files (bsc#1178752 CVE-2020-28367)\n  * go#42557 cmd/go: improper validation of cgo flags can lead to remote code execution at build time (bsc#1178753 CVE-2020-28366)\n  * go#42169 cmd/compile, runtime, reflect: pointers to go:notinheap types must be stored indirectly in interfaces\n  * go#42151 cmd/cgo: opaque struct pointers are broken since Go 1.15.3\n  * go#42138 time: Location interprets wrong timezone (DST) with slim zoneinfo\n  * go#42113 x/net/http2: the first write error on a connection will cause all subsequent write requests to fail blindly\n  * go#41914 net/http: request.Clone doesn't deep copy TransferEncoding\n  * go#41704 runtime: macOS syscall.Exec can get SIGILL due to preemption signal\n  * go#41463 compress/flate: deflatefast produces corrupted output\n  * go#41387 x/net/http2: connection-level flow control not returned if stream errors, causes server hang\n  * go#40974 cmd/link: sectionForAddress(0xA9D67F) address not in any section file\n","status":"published","published":"2020-11-19T08:24:49Z","modified":"2026-02-04T04:01:40.902856Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3369-1","title":"Security update for go1.14","description":"This update for go1.14 fixes the following issues:\n\n- go1.14.12 (released 2020-11-12) includes security fixes to the cmd/go and math/big packages.\n  * go#42553 math/big: panic during recursive division of very large numbers (bsc#1178750 CVE-2020-28362)\n  * go#42560 cmd/go: arbitrary code can be injected into cgo generated files (bsc#1178752 CVE-2020-28367)\n  * go#42557 cmd/go: improper validation of cgo flags can lead to remote code execution at build time (bsc#1178753 CVE-2020-28366)\n  * go#42155 time: Location interprets wrong timezone (DST) with slim zoneinfo\n  * go#42112 x/net/http2: the first write error on a connection will cause all subsequent write requests to fail blindly\n  * go#41991 runtime: macOS-only segfault on 1.14+ with 'split stack overflow'\n  * go#41913 net/http: request.Clone doesn't deep copy TransferEncoding\n  * go#41703 runtime: macOS syscall.Exec can get SIGILL due to preemption signal\n  * go#41386 x/net/http2: connection-level flow control not returned if stream errors, causes server hang\n","status":"published","published":"2020-11-19T08:26:22Z","modified":"2026-02-04T02:23:40.308155Z","updated_at":"2026-11-02T15:53:48.11786Z"}]}}