{"id":"CVE-2023-29403","aliases":["ALPINE-CVE-2023-29403","ALSA-2023:3922","ALSA-2023:3923","AZL-27112","AZL-27121","AZL-37301","AZL-37368","AZL-52789","AZL-79002","AZL-98901","BELL-CVE-2023-29403","BIT-golang-2023-29403","DEBIAN-CVE-2023-29403","EUVD-2023-32974","GHSA-rxx3-4978-3cc9","GO-2023-1840","MGASA-2023-0227","OESA-2023-1404","RHSA-2023:3920","RHSA-2023:3922","RHSA-2023:3923","RLSA-2023:3923","SUSE-SU-2023:2525-1","SUSE-SU-2023:2526-1","UBUNTU-CVE-2023-29403","USN-7061-1","USN-7109-1","openSUSE-SU-2024:12987-1","openSUSE-SU-2024:12988-1"],"status":"published","title":"Unsafe behavior in setuid/setgid binaries in runtime","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00429,"percentile":0.37373,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-642","CWE-668"],"published":"2023-06-08T20:16:06Z","modified":"2026-11-03T06:32:48Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"go","fixed_in":["1.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"go","fixed_in":["1.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"go","fixed_in":["1.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"go","fixed_in":["1.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"go","fixed_in":["1.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"go","fixed_in":["1.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.20.5-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"golang","fixed_in":["1.20.7-1","1.21.6-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"msft-golang","fixed_in":["1.20.7-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"golang","fixed_in":["1.20.7-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.19.10","1.20.5"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.19.10","1.20.5"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"golang","fixed_in":["1.15.7-29.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"golang","fixed_in":["1.15.7-29.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"golang","fixed_in":["1.17.3-19.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"golang","fixed_in":["1.17.3-19.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"golang","fixed_in":["1.17.3-19.oe2203sp2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.18","fixed_in":["1.18.1-1ubuntu1~16.04.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.18","fixed_in":["1.18.1-1ubuntu1~18.04.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","fixed_in":["1.18.1-1ubuntu1~20.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","fixed_in":["1.17.13-3ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","fixed_in":["1.18.1-1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0"},{"fixed":"1.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0"},{"fixed":"1.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0"},{"fixed":"1.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0"},{"fixed":"1.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0"},{"fixed":"1.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0"},{"fixed":"1.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0"},{"fixed":"1.20.5-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-1.module_el8.8.0+3471+a62632a0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.0"},{"fixed":"1.20.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"msft-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0"},{"fixed":"1.21.6-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.6-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.25.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.10"},{"introduced":"1.20.0"},{"fixed":"1.20.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.10-1","1.19.10-2","1.19.11-1","1.19.12-1","1.19.12-2","1.19.12-2~bpo11+1","1.19.12-2~bpo12+1","1.19.13-1","1.19.13-1~bpo11+1","1.19.13-1~bpo12+1","1.19.8-2","1.19.9-1"]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.10"},{"introduced":"1.20.0-0"},{"fixed":"1.20.5"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-29.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-29.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-19.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-19.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-19.oe2203sp2"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-scldevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.1-1.module+el8.8.0+16778+5fbb74f5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.1-1.module+el8.8.0+16778+5fbb74f5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.1-1.module+el8.8.0+16778+5fbb74f5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-150000.1.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-150000.1.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"go1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-150000.1.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-150000.1.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-150000.1.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5-150000.1.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5-150000.1.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5-150000.1.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5-150000.1.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5-150000.1.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~16.04.6+esm1"}]}],"versions":["1.18.1-1ubuntu1~16.04.6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~16.04.2","1.13.8-1ubuntu1~16.04.3","1.13.8-1ubuntu1~16.04.3+esm2","1.13.8-1ubuntu1~16.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10~rc1-1","1.10~rc1-1ubuntu1","1.10~rc1-2ubuntu1","1.10~rc2-1ubuntu1","1.10-1ubuntu1","1.10.1-1ubuntu2","1.10.4-2ubuntu1~18.04.1","1.10.4-2ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~18.04.2","1.13.8-1ubuntu1~18.04.3","1.13.8-1ubuntu1~18.04.4","1.13.8-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~18.04.2","1.16.2-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~18.04.4+esm1"}]}],"versions":["1.18.1-1ubuntu1~18.04.3","1.18.1-1ubuntu1~18.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~20.04.3"}]}],"versions":["1.18.1-1ubuntu1~20.04.1","1.18.1-1ubuntu1~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.1-1ubuntu1","1.13.3-1ubuntu1","1.13.4-1ubuntu1","1.13.5-1ubuntu1","1.13.6-1ubuntu1","1.13.6-2ubuntu1","1.13.7-1ubuntu1","1.13.8-1ubuntu1","1.13.8-1ubuntu1.1","1.13.8-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14~beta1-1","1.14~beta1-2","1.14~rc1-1","1.14-1","1.14.1-1","1.14.2-1","1.14.2-1ubuntu1","1.14.3-2ubuntu2~20.04.1","1.14.3-2ubuntu2~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~20.04","1.16.2-0ubuntu1~20.04.1","1.16.2-0ubuntu1~20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~20.04","1.20.3-1ubuntu0.1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.13-3ubuntu1.2"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1.2"}]}],"versions":["1.18~beta1-0ubuntu1","1.18~beta2-1ubuntu1","1.18~beta2-1ubuntu2","1.18~rc1-1ubuntu1","1.18-1ubuntu1","1.18.1-1ubuntu1","1.18.1-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~22.04","1.20.3-1ubuntu0.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu2","1.13.8-1ubuntu2.22.04.1","1.13.8-1ubuntu2.22.04.1+esm1","1.13.8-1ubuntu2.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.13-3ubuntu1.2"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~16.04.6+esm1"}]}],"versions":["1.18.1-1ubuntu1~16.04.6"],"bundled":25},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~18.04.4+esm1"}]}],"versions":["1.18.1-1ubuntu1~18.04.3","1.18.1-1ubuntu1~18.04.4"],"bundled":25},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~20.04.3"}]}],"versions":["1.18.1-1ubuntu1~20.04.1","1.18.1-1ubuntu1~20.04.2"],"bundled":25},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1.2"}]}],"versions":["1.18~beta1-0ubuntu1","1.18~beta2-1ubuntu1","1.18~beta2-1ubuntu2","1.18~rc1-1ubuntu1","1.18-1ubuntu1","1.18.1-1ubuntu1","1.18.1-1ubuntu1.1"],"bundled":25},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5-1.1"}]}],"bundled":4}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"go standard library","product":"runtime"},{"vendor":"golang","product":"go"},{"vendor":"jetbrains","product":"runtime"}],"references":[{"url":"https://go.dev/issue/60272","tags":["x_transferred","Issue Tracking","report","web","article"]},{"url":"https://go.dev/cl/501223","tags":["x_transferred","Patch","fix","web","article"]},{"url":"https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ","tags":["x_transferred","Mailing List","Release Notes","discussion","web","article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1840","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/","tags":["x_transferred","Mailing List","discussion","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/","tags":["x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202311-09","tags":["x_transferred","web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241220-0009/","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29403","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX"},{"url":"https://security.netapp.com/advisory/ntap-20241220-0009"},{"url":"https://github.com/advisories/GHSA-rxx3-4978-3cc9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-29403","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3922","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29402","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29403","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29404","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29405","tags":["report"]},{"url":"https://bugzilla.redhat.com/2216965","tags":["report"]},{"url":"https://bugzilla.redhat.com/2217562","tags":["report"]},{"url":"https://bugzilla.redhat.com/2217565","tags":["report"]},{"url":"https://bugzilla.redhat.com/2217569","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-3922.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3923","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-3923.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-29403","tags":["advisory"]},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29403.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-29403","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0227.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32052","tags":["report"]},{"url":"https://groups.google.com/g/golang-announce/c/q5135a9d924","tags":["web","report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1404","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3920","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216965","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2217562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2217565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2217569","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3920.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29402","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29402","tags":["advisory"]},{"url":"https://go.dev/cl/501226","tags":["article"]},{"url":"https://go.dev/issue/60167","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1839","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29403","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29404","tags":["advisory"]},{"url":"https://go.dev/cl/501225","tags":["article"]},{"url":"https://go.dev/issue/60305","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1841","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29405","tags":["advisory"]},{"url":"https://go.dev/cl/501224","tags":["article"]},{"url":"https://go.dev/issue/60306","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1842","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3922.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3923.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:3923","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232525-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200441","tags":["report"]},{"url":"https://bugzilla.suse.com/1212073","tags":["report"]},{"url":"https://bugzilla.suse.com/1212074","tags":["report"]},{"url":"https://bugzilla.suse.com/1212075","tags":["report"]},{"url":"https://bugzilla.suse.com/1212076","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29405","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232526-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29403","tags":["report"]},{"url":"https://github.com/golang/go/issues/60272","tags":["report"]},{"url":"https://github.com/golang/go/commit/36144ba429ef2650940c72e7a0b932af3612d420","tags":["report"]},{"url":"https://github.com/golang/go/commit/a7b1cd452ddc69a6606c2f35ac5786dc892e62cb","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7061-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7109-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-24531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-24538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29402","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29404","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41723","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41725","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-24536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24789","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24791","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-34155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-34156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-34158","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-29403","title":"Unsafe behavior in setuid/setgid binaries in runtime","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T20:19:13.222Z","modified":"2025-02-13T16:49:14.029Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:35:28.218693Z"}],"euvd":[{"id":"EUVD-2023-32974","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T20:19:13Z","modified":"2025-02-13T16:49:14Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:03:50.947767Z"}],"ghsa":[{"id":"GHSA-rxx3-4978-3cc9","title":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the...","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T21:30:27Z","modified":"2024-12-20T15:31:46Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-642","CWE-668"],"updated_at":"2026-11-02T14:59:14.691333Z"}],"nvd":[{"id":"CVE-2023-29403","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T21:15:16.927Z","modified":"2026-06-17T05:49:58.43Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:08:05.329837Z"}],"osv":[{"id":"ALPINE-CVE-2023-29403","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T21:15:16.927Z","modified":"2026-11-03T06:32:48.380119815Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"AZL-27112","title":"CVE-2023-29403 affecting package golang for versions less than 1.20.7-1","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T21:15:16Z","modified":"2026-04-21T04:24:03.386703Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-27121","title":"CVE-2023-29403 affecting package msft-golang for versions less than 1.20.7-1","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T21:15:16Z","modified":"2026-04-21T04:24:03.781803Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-37301","title":"CVE-2023-29403 affecting package golang for versions less than 1.21.6-1","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T21:15:16Z","modified":"2026-04-21T04:28:15.152279Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-37368","title":"CVE-2023-29403 affecting package golang for versions less than 1.21.6-1","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T21:15:16Z","modified":"2026-04-21T04:28:17.66948Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-52789","title":"CVE-2023-29403 affecting package golang for versions less than 1.20.7-1","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T21:15:16Z","modified":"2026-04-21T04:55:37.149993Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"AZL-79002","title":"CVE-2023-29403 affecting package golang 1.25.7-1","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T21:15:16Z","modified":"2026-04-21T04:34:34.391018Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"AZL-98901","title":"CVE-2023-29403 affecting package golang 1.27.1-1","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T21:15:16Z","modified":"2026-09-16T06:39:01Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BELL-CVE-2023-29403","title":"CVE-2023-29403 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:10.432838Z","modified":"2026-01-26T09:47:45.134732Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-29403","title":"Unsafe behavior in setuid/setgid binaries in runtime","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T20:19:13.222Z","modified":"2026-10-28T02:30:24.07012299Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"DEBIAN-CVE-2023-29403","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T21:15:16.927Z","modified":"2026-10-26T18:00:55.271275491Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"OESA-2023-1404","title":"golang security update","description":"The Go Programming Language\n\nSecurity Fix(es):\n\nOn Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.(CVE-2023-29403)","status":"published","published":"2023-07-08T11:05:52Z","modified":"2026-08-18T01:17:45.502814936Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"RHSA-2023:3920","title":"Red Hat Security Advisory: go-toolset-1.19 and go-toolset-1.19-golang security update","status":"published","published":"2024-09-18T05:00:55Z","modified":"2026-06-26T11:05:29Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3922","title":"Red Hat Security Advisory: go-toolset:rhel8 security update","status":"published","published":"2024-09-18T05:01:05Z","modified":"2026-03-23T04:47:38.108188Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3923","title":"Red Hat Security Advisory: go-toolset and golang security update","status":"published","published":"2024-09-18T05:01:24Z","modified":"2026-03-23T04:49:30.838146Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"UBUNTU-CVE-2023-29403","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T21:15:00Z","modified":"2026-05-20T16:13:35.167101617Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"ALSA-2023:3922","title":"Critical: go-toolset:rhel8 security update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang: cmd/go: go command may generate unexpected code at build time when using cgo (CVE-2023-29402)\n* golang: cmd/go: go command may execute arbitrary code at build time when using cgo (CVE-2023-29404)\n* golang: cmd/cgo: Arbitratry code execution triggered by linker flags (CVE-2023-29405)\n* golang: runtime: unexpected behavior of setuid/setgid binaries (CVE-2023-29403)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-06-29T00:00:00Z","modified":"2026-10-29T11:02:09.342077327Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:3923","title":"Critical: go-toolset and golang security update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nThe golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang: cmd/go: go command may generate unexpected code at build time when using cgo (CVE-2023-29402)\n* golang: cmd/go: go command may execute arbitrary code at build time when using cgo (CVE-2023-29404)\n* golang: cmd/cgo: Arbitratry code execution triggered by linker flags (CVE-2023-29405)\n* golang: runtime: unexpected behavior of setuid/setgid binaries (CVE-2023-29403)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-06-29T00:00:00Z","modified":"2026-10-29T11:31:28.265141347Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"BIT-golang-2023-29403","title":"Unsafe behavior in setuid/setgid binaries in runtime","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2024-03-06T10:55:36.361Z","modified":"2026-09-08T08:47:48.870104143Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"GO-2023-1840","title":"Unsafe behavior in setuid/setgid binaries in runtime","description":"On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors.\n\nIf a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.","status":"published","published":"2023-06-08T20:16:06Z","modified":"2026-02-04T03:48:08.792378Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"MGASA-2023-0227","title":"Updated golang packages fix security vulnerability","description":"Code injection via go command with cgo in cmd/go (CVE-2023-29402)\nIgnoring setuid/setgid bits. (CVE-2023-29403)\nArbitrary code execution (CVE-2023-29404)\nArbitrary code execution (CVE-2023-29405)\n","status":"published","published":"2023-07-07T05:54:45Z","modified":"2026-04-16T04:43:51.269405776Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12987-1","title":"go1.19-1.19.10-1.1 on GA media","description":"These are all security issues fixed in the go1.19-1.19.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:10:43.33411Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:12988-1","title":"go1.20-1.20.5-1.1 on GA media","description":"These are all security issues fixed in the go1.20-1.20.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:16:20.297062Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"RLSA-2023:3923","title":"Critical: go-toolset and golang security update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nThe golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang: cmd/go: go command may generate unexpected code at build time when using cgo (CVE-2023-29402)\n\n* golang: cmd/go: go command may execute arbitrary code at build time when using cgo (CVE-2023-29404)\n\n* golang: cmd/cgo: Arbitratry code execution triggered by linker flags (CVE-2023-29405)\n\n* golang: runtime: unexpected behavior of setuid/setgid binaries (CVE-2023-29403)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-07-08T02:54:41.143214Z","modified":"2026-02-04T17:15:13.591435Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2023:2525-1","title":"Security update for go1.19","description":"This update for go1.19 fixes the following issues:\n\nUpdate to go1.19.10 (bsc#1200441):\n\n- CVE-2023-29402: cmd/go: Fixed cgo code injection (bsc#1212073).                                                                                                                              \n- CVE-2023-29403: runtime: Fixed unexpected behavior of setuid/setgid binaries (bsc#1212074).                                                                                                  \n- CVE-2023-29404: cmd/go: Fixed improper sanitization of LDFLAGS (bsc#1212075).                                                                                                                \n- CVE-2023-29405: cmd/go: Fixed improper sanitization of LDFLAGS (bsc#1212076).                                                                                                                \n","status":"published","published":"2023-06-16T15:33:08Z","modified":"2026-02-04T04:08:50.575902Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2526-1","title":"Security update for go1.20","description":"This update for go1.20 fixes the following issues:\n\nUpdate to go1.20.5 (bsc#1206346):\n\n- CVE-2023-29402: cmd/go: Fixed cgo code injection (bsc#1212073).                                                                                                                              \n- CVE-2023-29403: runtime: Fixed unexpected behavior of setuid/setgid binaries (bsc#1212074).                                                                                                  \n- CVE-2023-29404: cmd/go: Fixed improper sanitization of LDFLAGS (bsc#1212075).                                                                                                                \n- CVE-2023-29405: cmd/go: Fixed improper sanitization of LDFLAGS (bsc#1212076).                                                                                                                \n","status":"published","published":"2023-06-16T15:33:41Z","modified":"2026-02-04T03:59:11.699004Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-7061-1","title":"golang-1.17 vulnerabilities","description":"Hunter Wittenborn discovered that Go incorrectly handled the sanitization\nof environment variables. An attacker could possibly use this issue to run\narbitrary commands. (CVE-2023-24531)\n\nSohom Datta discovered that Go did not properly validate backticks (`) as\nJavascript string delimiters, and did not escape them as expected. An\nattacker could possibly use this issue to inject arbitrary Javascript code\ninto the Go template. (CVE-2023-24538)\n\nJuho Nurminen discovered that Go incorrectly handled certain special\ncharacters in directory or file paths. An attacker could possibly use\nthis issue to inject code into the resulting binaries. (CVE-2023-29402)\n\nVincent Dehors discovered that Go incorrectly handled permission bits.\nAn attacker could possibly use this issue to read or write files with\nelevated privileges. (CVE-2023-29403)\n\nJuho Nurminen discovered that Go incorrectly handled certain crafted\narguments. An attacker could possibly use this issue to execute arbitrary\ncode at build time. (CVE-2023-29405)\n\nIt was discovered that Go incorrectly validated the contents of host\nheaders. A remote attacker could possibly use this issue to inject\nadditional headers or entire requests. (CVE-2023-29406)\n\nTakeshi Kaneko discovered that Go did not properly handle comments and\nspecial tags in the script context of html/template module. An attacker\ncould possibly use this issue to inject Javascript code and perform a\ncross-site scripting attack. (CVE-2023-39318, CVE-2023-39319)\n\nIt was discovered that Go did not limit the number of simultaneously\nexecuting handler goroutines in the net/http module. An attacker could\npossibly use this issue to cause a panic resulting in a denial of service.\n(CVE-2023-39325)\n\nIt was discovered that the Go html/template module did not validate errors\nreturned from MarshalJSON methods. An attacker could possibly use this\nissue to inject arbitrary code into the Go template. (CVE-2024-24785)\n","status":"published","published":"2024-10-10T12:55:01Z","modified":"2026-04-27T17:30:53.50497Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7109-1","title":"golang-1.18 vulnerabilities","description":"Philippe Antoine discovered that Go incorrectly handled crafted HTTP/2\nstreams. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2022-41723)\n\nMarten Seemann discovered that Go did not properly manage memory under\ncertain circumstances. An attacker could possibly use this issue to cause\na panic resulting in a denial of service. (CVE-2022-41724)\n\nAmeya Darshan and Jakob Ackermann discovered that Go did not properly\nvalidate the amount of memory and disk files ReadForm can consume. An\nattacker could possibly use this issue to cause a panic resulting in a\ndenial of service. (CVE-2022-41725)\n\nHunter Wittenborn discovered that Go incorrectly handled the sanitization\nof environment variables. An attacker could possibly use this issue to run\narbitrary commands. (CVE-2023-24531)\n\nJakob Ackermann discovered that Go incorrectly handled multipart\nforms. An attacker could possibly use this issue to consume an excessive\namount of resources, resulting in a denial of service. (CVE-2023-24536)\n\nJuho Nurminen discovered that Go incorrectly handled certain special\ncharacters in directory or file paths. An attacker could possibly use\nthis issue to inject code into the resulting binaries. (CVE-2023-29402)\n\nVincent Dehors discovered that Go incorrectly handled permission bits.\nAn attacker could possibly use this issue to read or write files with\nelevated privileges. (CVE-2023-29403)\n\nJuho Nurminen discovered that Go incorrectly handled certain compiler\ndirectives. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2023-29404)\n\nJuho Nurminen discovered that Go incorrectly handled certain crafted\narguments. An attacker could possibly use this issue to execute arbitrary\ncode at build time. (CVE-2023-29405)\n\nBartek Nowotarski discovered that Go incorrectly validated the contents of\nhost headers. A remote attacker could possibly use this issue to inject\nadditional headers or entire requests. (CVE-2023-29406)\n\nTakeshi Kaneko discovered that Go did not properly handle comments and\nspecial tags in the script context of html/template module. An attacker\ncould possibly use this issue to inject Javascript code and perform a\ncross-site scripting attack. (CVE-2023-39318, CVE-2023-39319)\n\nIt was discovered that Go did not properly validate the \"//go:cgo_\"\ndirectives during compilation. An attacker could possibly use this issue\nto inject arbitrary code during compile time. (CVE-2023-39323)\n\nIt was discovered that Go did not limit the number of simultaneously\nexecuting handler goroutines in the net/http module. An attacker could\npossibly use this issue to cause a panic resulting in a denial of service.\n(CVE-2023-39325)\n\nBartek Nowotarski was discovered that the Go net/http module did not\nproperly handle the requests when request's headers exceed MaxHeaderBytes.\nAn attacker could possibly use this issue to cause a panic resulting into\na denial of service. (CVE-2023-45288)\n\nBartek Nowotarski discovered that the Go net/http module did not properly\nvalidate the total size of the parsed form when parsing a multipart form.\nAn attacker could possibly use this issue to cause a panic resulting into a\ndenial of service. (CVE-2023-45290)\n\nJohn Howard discovered that the Go crypto/x509 module did not properly\nhandle a certificate chain which contains a certificate with an unknown\npublic key algorithm. An attacker could possibly use this issue to cause\na panic resulting into a denial of service. (CVE-2024-24783)\n\nJuho Nurminen discovered that the Go net/mail module did not properly\nhandle comments within display names in the ParseAddressList function.\nAn attacker could possibly use this issue to cause a panic resulting into\na denial of service. (CVE-2024-24784)\n\nIt was discovered that the Go html/template module did not validate errors\nreturned from MarshalJSON methods. An attacker could possibly use this\nissue to inject arbitrary code into the Go template. (CVE-2024-24785)\n\nYufan You discovered that the Go archive/zip module did not properly\nhandle certain types of invalid zip files differs from the behavior of\nmost zip implementations. An attacker could possibly use this issue to\ncause a panic resulting into a denial of service. (CVE-2024-24789)\n\nEnze Wang and Jianjun Chen discovered that the Go net/netip module did\nnot work as expected for IPv4-mapped IPv6 addresses in various Is methods.\nAn attacker could possibly use this issue to cause a panic resulting into\na denial of service. (CVE-2024-24790)\n\nGeoff Franks discovered that the Go net/http module did not properly\nhandle responses to requests with an \"Expect: 100-continue\" header under\ncertain circumstances. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2024-24791)\n\nIt was discovered that the Go parser module did not properly handle deeply\nnested literal values. An attacker could possibly use this issue to cause\na panic resulting in a denial of service. (CVE-2024-34155)\n\nMd Sakib Anwar discovered that the Go encoding/gob module did not properly\nhandle message decoding under certain circumstances. An attacker could\npossibly use this issue to cause a panic resulting in a denial of service.\n(CVE-2024-34156)\n\nIt was discovered that the Go build module did not properly handle certain\nbuild tag lines with deeply nested expressions. An attacker could possibly\nuse this issue to cause a panic resulting in a denial of service.\n(CVE-2024-34158)\n","status":"published","published":"2024-11-14T13:57:58Z","modified":"2026-06-25T13:32:29.525356949Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}