{"id":"CVE-2021-3115","aliases":["ALPINE-CVE-2021-3115","AZL-38572","BELL-CVE-2021-3115","BIT-golang-2021-3115","DEBIAN-CVE-2021-3115","EUVD-2021-26467","GHSA-79cw-x93g-q95p","GO-2021-0068","RHSA-2021:1339","RHSA-2021:1746","RHSA-2021:2095","RLSA-2021:1746","SUSE-SU-2021:0222-1","SUSE-SU-2021:0223-1","openSUSE-SU-2021:0190-1","openSUSE-SU-2021:0192-1","openSUSE-SU-2021:0194-1","openSUSE-SU-2024:10807-1","openSUSE-SU-2024:10808-1"],"status":"published","title":"Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and...","description":"Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the \"go get\" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.06905,"percentile":0.94131,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-427","CWE-77","CWE-94"],"published":"2021-01-26T02:14:51Z","modified":"2026-11-03T06:32:33Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"go","fixed_in":["1.15.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"go","fixed_in":["1.15.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"go","fixed_in":["1.15.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"go","fixed_in":["1.15.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"go","fixed_in":["1.15.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"go","fixed_in":["1.15.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"go","fixed_in":["1.15.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"go","fixed_in":["1.15.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"go","fixed_in":["1.15.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"go","fixed_in":["1.15.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"go","fixed_in":["1.15.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.15.7-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-tensorboard","fixed_in":["2.16.2-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.14.14","1.15.7"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"golang-1.15","fixed_in":["1.15.7-1"],"sources":["osv"]},{"ecosystem":"Go","package":"toolchain","fixed_in":["1.14.14","1.15.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15"},{"fixed":"1.15.7-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tensorboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.2-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.14.14"},{"introduced":"1.15.0"},{"fixed":"1.15.7"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"golang-1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-1"}]}]},{"source":"osv","ecosystem":"Go","package":"toolchain","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.14.14"},{"introduced":"1.15.0-0"},{"fixed":"1.15.7"}]}]},{"source":"osv","ecosystem":"Red Hat:serverless:1.0::el8","package":"openshift-serverless-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.20.0-6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.module+el8.4.0+8864+58b0fcdb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.module+el8.4.0+8864+58b0fcdb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.module+el8.4.0+8864+58b0fcdb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-1.module+el8.4.0+9580+3b0e6c24"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-1.module+el8.4.0+9580+3b0e6c24"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-1.module+el8.4.0+9580+3b0e6c24"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-1.module+el8.4.0+9580+3b0e6c24"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-1.module+el8.4.0+9580+3b0e6c24"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-1.module+el8.4.0+9580+3b0e6c24"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-1.module+el8.4.0+9580+3b0e6c24"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-1.module+el8.4.0+9580+3b0e6c24"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:serverless:1.0::el8","package":"openshift-serverless-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.20.0-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.module+el8.4.0+396+d2d16ae3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-1.module+el8.4.0+396+d2d16ae3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-1.module+el8.4.0+396+d2d16ae3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.14-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.14-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.14-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.14-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.14-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.14-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.14-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.14-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.14-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.14-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-1.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-1.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-1.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-1.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-1.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-1.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-1.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-1.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-1.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-1.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.14-lp151.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-lp152.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.14-lp152.2.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.15-1.6"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.15-1.2"}]}],"bundled":14}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"golang","product":"go"},{"vendor":"netapp","product":"cloud_insights_telegraf_agent"},{"vendor":"netapp","product":"storagegrid"}],"references":[{"url":"https://groups.google.com/g/golang-announce/c/mperVMGa98w","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","article"]},{"url":"https://blog.golang.org/path-security","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWAYJGXWC232SG3UR3TR574E6BP3OSQQ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210219-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202208-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3115","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YWAYJGXWC232SG3UR3TR574E6BP3OSQQ/"},{"url":"https://github.com/advisories/GHSA-79cw-x93g-q95p"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-3115","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-3115","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3115","tags":["advisory"]},{"url":"https://go.dev/cl/284783","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/953d1feca9b21af075ad5fc8a3dad096d3ccc3a0","tags":["fix"]},{"url":"https://go.dev/issue/43783","tags":["report"]},{"url":"https://groups.google.com/g/golang-announce/c/mperVMGa98w/m/yo5W5wnvAAAJ","tags":["web"]},{"url":"https://go.dev/cl/284780","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/46e2e2e9d99925bbf724b12693c6d3e27a95d6a0","tags":["fix"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1339","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless_applications/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1918750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1918761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941695","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1339.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3114","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3114","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3115","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3115","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1746","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1746.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2095","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2095.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:1746","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210222-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1164903","tags":["report"]},{"url":"https://bugzilla.suse.com/1181145","tags":["report"]},{"url":"https://bugzilla.suse.com/1181146","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3115","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210223-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1175132","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/C6AHVSSFZQ2VAOK2PGQ7E4WNIXZEO6OV/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DLSYUO4X4LW4VZTYIOWDRLII23FZ4LSP/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5JVN2JM5TB7JXDFH25XPTVDVURPTQ3WB/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36221","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-3115","description":"Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the \"go get\" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).","status":"published","published":"2021-01-26T02:14:51Z","modified":"2024-08-03T16:45:51.223Z","updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26467","description":"Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the \"go get\" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).","status":"published","published":"2021-01-26T02:14:51Z","modified":"2024-08-03T16:45:51Z","updated_at":"2026-11-03T03:25:13.531128Z"}],"ghsa":[{"id":"GHSA-79cw-x93g-q95p","title":"Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and...","description":"Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the \"go get\" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).","status":"published","published":"2022-05-24T17:40:22Z","modified":"2023-01-27T05:03:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77","CWE-94","CWE-427"],"updated_at":"2026-11-02T14:42:16.196802Z"}],"nvd":[{"id":"CVE-2021-3115","description":"Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the \"go get\" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).","status":"published","published":"2021-01-26T18:16:27.63Z","modified":"2026-06-17T04:04:41.61Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:06:49.660551Z"}],"osv":[{"id":"ALPINE-CVE-2021-3115","description":"Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the \"go get\" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).","status":"published","published":"2021-01-26T18:16:27.63Z","modified":"2026-11-03T06:32:33.311256577Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"AZL-38572","title":"CVE-2021-3115 affecting package python-tensorboard for versions less than 2.16.2-1","description":"Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the \"go get\" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).","status":"published","published":"2021-01-26T18:16:27Z","modified":"2026-04-21T04:55:50.458985Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"BELL-CVE-2021-3115","title":"CVE-2021-3115 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:33.478769Z","modified":"2026-01-26T09:48:07.928072Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-3115","description":"Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the \"go get\" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).","status":"published","published":"2021-01-26T18:16:27.63Z","modified":"2026-10-24T10:30:45.146741299Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"DEBIAN-CVE-2021-3115","description":"Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the \"go get\" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).","status":"published","published":"2021-01-26T18:16:27.63Z","modified":"2026-08-27T23:04:02.111986939Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"RHSA-2021:1339","title":"Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.14.0 and security update","status":"published","published":"2024-09-18T04:17:36Z","modified":"2026-08-08T10:01:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:1746","title":"Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update","status":"published","published":"2024-09-18T04:18:17Z","modified":"2026-08-08T10:01:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:2095","title":"Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.14.1 security update","status":"published","published":"2024-09-18T04:18:15Z","modified":"2026-08-08T10:01:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2021:1746","title":"Moderate: go-toolset:rhel8 security, bug fix, and enhancement update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nThe following packages have been upgraded to a later upstream version: golang (1.15.7), delve (1.5.0). (BZ#1870531)\n\nSecurity Fix(es):\n\n* golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)\n\n* golang: cmd/go: packages using cgo can cause arbitrary code execution at build time (CVE-2021-3115)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.","status":"published","published":"2021-05-18T05:59:11Z","modified":"2026-02-04T14:45:03.22287Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"BIT-golang-2021-3115","description":"Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the \"go get\" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).","status":"published","published":"2024-03-06T11:05:46.661Z","modified":"2026-09-08T08:47:48.322755949Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"GO-2021-0068","title":"Arbitrary code injection via the go command with cgo on Windows in cmd/go","description":"The go command may execute arbitrary code at build time when using cgo on Windows. This can be triggered by running go get on a malicious module, or any other time the code is built.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"openSUSE-SU-2021:0190-1","title":"Security update for go1.14","description":"This update for go1.14 fixes the following issues:\n\nGo was updated to version 1.14.14 (bsc#1164903).\n\nSecurity issues fixed:\n\n- CVE-2021-3114: Fixed incorrect operations on the P-224 curve in crypto/elliptic (bsc#1181145).\n- CVE-2021-3115: Fixed a potential arbitrary code execution in the build process (bsc#1181146).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-01-29T19:14:06Z","modified":"2026-02-04T02:43:22.626219Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0192-1","title":"Security update for go1.15","description":"This update for go1.15 fixes the following issues:\n\nGo was updated to version 1.15.7 (bsc#1175132).\n\nSecurity issues fixed:\n\n- CVE-2021-3114: Fixed incorrect operations on the P-224 curve in crypto/elliptic (bsc#1181145).\n- CVE-2021-3115: Fixed a potential arbitrary code execution in the build process (bsc#1181146).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-01-29T19:14:21Z","modified":"2026-02-04T03:51:39.594956Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0194-1","title":"Security update for go1.14","description":"This update for go1.14 fixes the following issues:\n\nGo was updated to version 1.14.14 (bsc#1164903).\n\nSecurity issues fixed:\n\n- CVE-2021-3114: Fixed incorrect operations on the P-224 curve in crypto/elliptic (bsc#1181145).\n- CVE-2021-3115: Fixed a potential arbitrary code execution in the build process (bsc#1181146).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-01-29T23:13:44Z","modified":"2026-02-04T04:00:47.416498Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10807-1","title":"go1.14-1.14.15-1.6 on GA media","description":"These are all security issues fixed in the go1.14-1.14.15-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:32:42.416924Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10808-1","title":"go1.15-1.15.15-1.2 on GA media","description":"These are all security issues fixed in the go1.15-1.15.15-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:46:55.765323Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:0222-1","title":"Security update for go1.14","description":"This update for go1.14 fixes the following issues:\n\nGo was updated to version 1.14.14 (bsc#1164903).\n\nSecurity issues fixed:\n\n- CVE-2021-3114: Fixed incorrect operations on the P-224 curve in crypto/elliptic (bsc#1181145).\n- CVE-2021-3115: Fixed a potential arbitrary code execution in the build process (bsc#1181146).\n","status":"published","published":"2021-01-26T14:05:32Z","modified":"2026-02-04T02:20:14.41746Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0223-1","title":"Security update for go1.15","description":"This update for go1.15 fixes the following issues:\n\nGo was updated to version 1.15.7 (bsc#1175132).\n\nSecurity issues fixed:\n\n- CVE-2021-3114: Fixed incorrect operations on the P-224 curve in crypto/elliptic (bsc#1181145).\n- CVE-2021-3115: Fixed a potential arbitrary code execution in the build process (bsc#1181146).\n","status":"published","published":"2021-01-28T09:11:12Z","modified":"2026-02-04T03:05:22.903297Z","updated_at":"2026-11-02T15:53:48.690034Z"}]}}