{"id":"CVE-2023-29405","aliases":["ALPINE-CVE-2023-29405","ALSA-2023:3922","ALSA-2023:3923","AZL-27110","AZL-27123","AZL-37347","AZL-37499","AZL-52827","AZL-79012","AZL-98760","BELL-CVE-2023-29405","BIT-golang-2023-29405","DEBIAN-CVE-2023-29405","EUVD-2023-32976","GHSA-68g3-2p3g-w9pq","GO-2023-1842","MGASA-2023-0227","OESA-2023-1386","OESA-2023-1499","RHSA-2023:3920","RHSA-2023:3922","RHSA-2023:3923","RLSA-2023:3923","SUSE-SU-2023:2525-1","SUSE-SU-2023:2526-1","UBUNTU-CVE-2023-29405","USN-7061-1","USN-7109-1","openSUSE-SU-2024:12987-1","openSUSE-SU-2024:12988-1"],"status":"published","title":"Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01714,"percentile":0.77697,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74","CWE-88"],"published":"2023-06-08T20:15:53Z","modified":"2026-11-03T06:32:48Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"go","fixed_in":["1.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"go","fixed_in":["1.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"go","fixed_in":["1.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"go","fixed_in":["1.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"go","fixed_in":["1.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"go","fixed_in":["1.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.20.5-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"golang","fixed_in":["1.20.7-1","1.21.6-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"msft-golang","fixed_in":["1.20.7-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"golang","fixed_in":["1.20.7-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.19.10","1.20.5"],"sources":["osv"]},{"ecosystem":"Go","package":"toolchain","fixed_in":["1.19.10","1.20.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.18","fixed_in":["1.18.1-1ubuntu1~16.04.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.18","fixed_in":["1.18.1-1ubuntu1~18.04.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","fixed_in":["1.18.1-1ubuntu1~20.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","fixed_in":["1.17.13-3ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","fixed_in":["1.18.1-1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0"},{"fixed":"1.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0"},{"fixed":"1.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0"},{"fixed":"1.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0"},{"fixed":"1.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0"},{"fixed":"1.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0"},{"fixed":"1.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0"},{"fixed":"1.20.5-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-1.module_el8.8.0+3471+a62632a0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.module_el8.8.0+3571+89db2ae0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.0"},{"fixed":"1.20.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"msft-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.6-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0"},{"fixed":"1.21.6-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.25.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.10"},{"introduced":"1.20.0"},{"fixed":"1.20.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.10-1","1.19.10-2","1.19.11-1","1.19.12-1","1.19.12-2","1.19.12-2~bpo11+1","1.19.12-2~bpo12+1","1.19.13-1","1.19.13-1~bpo11+1","1.19.13-1~bpo12+1","1.19.8-2","1.19.9-1"]},{"source":"osv","ecosystem":"Go","package":"toolchain","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.10"},{"introduced":"1.20.0-0"},{"fixed":"1.20.5"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-28.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-28.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-19.oe2203sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-19.oe2203sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-20.oe2203sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-scldevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el7_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.1-1.module+el8.8.0+16778+5fbb74f5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.1-1.module+el8.8.0+16778+5fbb74f5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.1-1.module+el8.8.0+16778+5fbb74f5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.module+el8.8.0+19203+782922b7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.10-1.el9_2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-150000.1.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-150000.1.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"go1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-150000.1.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-150000.1.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-150000.1.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5-150000.1.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5-150000.1.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5-150000.1.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5-150000.1.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5-150000.1.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~16.04.6+esm1"}]}],"versions":["1.18.1-1ubuntu1~16.04.6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~16.04.2","1.13.8-1ubuntu1~16.04.3","1.13.8-1ubuntu1~16.04.3+esm2","1.13.8-1ubuntu1~16.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10~rc1-1","1.10~rc1-1ubuntu1","1.10~rc1-2ubuntu1","1.10~rc2-1ubuntu1","1.10-1ubuntu1","1.10.1-1ubuntu2","1.10.4-2ubuntu1~18.04.1","1.10.4-2ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~18.04.2","1.13.8-1ubuntu1~18.04.3","1.13.8-1ubuntu1~18.04.4","1.13.8-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~18.04.2","1.16.2-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~18.04.4+esm1"}]}],"versions":["1.18.1-1ubuntu1~18.04.3","1.18.1-1ubuntu1~18.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~20.04.3"}]}],"versions":["1.18.1-1ubuntu1~20.04.1","1.18.1-1ubuntu1~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.1-1ubuntu1","1.13.3-1ubuntu1","1.13.4-1ubuntu1","1.13.5-1ubuntu1","1.13.6-1ubuntu1","1.13.6-2ubuntu1","1.13.7-1ubuntu1","1.13.8-1ubuntu1","1.13.8-1ubuntu1.1","1.13.8-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14~beta1-1","1.14~beta1-2","1.14~rc1-1","1.14-1","1.14.1-1","1.14.2-1","1.14.2-1ubuntu1","1.14.3-2ubuntu2~20.04.1","1.14.3-2ubuntu2~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~20.04","1.16.2-0ubuntu1~20.04.1","1.16.2-0ubuntu1~20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~20.04","1.20.3-1ubuntu0.1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.13-3ubuntu1.2"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1.2"}]}],"versions":["1.18~beta1-0ubuntu1","1.18~beta2-1ubuntu1","1.18~beta2-1ubuntu2","1.18~rc1-1ubuntu1","1.18-1ubuntu1","1.18.1-1ubuntu1","1.18.1-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~22.04","1.20.3-1ubuntu0.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu2","1.13.8-1ubuntu2.22.04.1","1.13.8-1ubuntu2.22.04.1+esm1","1.13.8-1ubuntu2.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.13-3ubuntu1.2"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~16.04.6+esm1"}]}],"versions":["1.18.1-1ubuntu1~16.04.6"],"bundled":25},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~18.04.4+esm1"}]}],"versions":["1.18.1-1ubuntu1~18.04.3","1.18.1-1ubuntu1~18.04.4"],"bundled":25},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1~20.04.3"}]}],"versions":["1.18.1-1ubuntu1~20.04.1","1.18.1-1ubuntu1~20.04.2"],"bundled":25},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu1.2"}]}],"versions":["1.18~beta1-0ubuntu1","1.18~beta2-1ubuntu1","1.18~beta2-1ubuntu2","1.18~rc1-1ubuntu1","1.18-1ubuntu1","1.18.1-1ubuntu1","1.18.1-1ubuntu1.1"],"bundled":25},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.10-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5-1.1"}]}],"bundled":4}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"go toolchain","product":"cmd/cgo"},{"vendor":"go toolchain","product":"cmd/go"},{"vendor":"golang","product":"go"}],"references":[{"url":"https://go.dev/issue/60306","tags":["x_transferred","Issue Tracking","report","web","article"]},{"url":"https://go.dev/cl/501224","tags":["x_transferred","Patch","fix","web","article"]},{"url":"https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web","article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1842","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/","tags":["x_transferred","Mailing List","discussion","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/","tags":["x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202311-09","tags":["x_transferred","web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241206-0003/","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29405","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX"},{"url":"https://security.netapp.com/advisory/ntap-20241206-0003"},{"url":"https://github.com/advisories/GHSA-68g3-2p3g-w9pq"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-29405","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3922","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29402","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29403","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29404","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29405","tags":["report"]},{"url":"https://bugzilla.redhat.com/2216965","tags":["report"]},{"url":"https://bugzilla.redhat.com/2217562","tags":["report"]},{"url":"https://bugzilla.redhat.com/2217565","tags":["report"]},{"url":"https://bugzilla.redhat.com/2217569","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-3922.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3923","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-3923.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-29405","tags":["advisory"]},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29405.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-29405","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0227.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32052","tags":["report"]},{"url":"https://groups.google.com/g/golang-announce/c/q5135a9d924","tags":["web","report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29402","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29404","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29406","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3920","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216965","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2217562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2217565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2217569","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3920.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29402","tags":["advisory"]},{"url":"https://go.dev/cl/501226","tags":["article"]},{"url":"https://go.dev/issue/60167","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1839","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29403","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29403","tags":["advisory"]},{"url":"https://go.dev/cl/501223","tags":["article"]},{"url":"https://go.dev/issue/60272","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1840","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29404","tags":["advisory"]},{"url":"https://go.dev/cl/501225","tags":["article"]},{"url":"https://go.dev/issue/60305","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1841","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29405","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3922.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3923.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:3923","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232525-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200441","tags":["report"]},{"url":"https://bugzilla.suse.com/1212073","tags":["report"]},{"url":"https://bugzilla.suse.com/1212074","tags":["report"]},{"url":"https://bugzilla.suse.com/1212075","tags":["report"]},{"url":"https://bugzilla.suse.com/1212076","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29405","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232526-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29405","tags":["report"]},{"url":"https://github.com/golang/go/issues/60306","tags":["report"]},{"url":"https://github.com/golang/go/commit/fa60c381ed06c12f9c27a7b50ca44c5f84f7f0f4","tags":["report"]},{"url":"https://github.com/golang/go/commit/1008486a9ff979dbd21c7466eeb6abf378f9c637","tags":["report"]},{"url":"https://github.com/golang/go/commit/44e0fb13e783a44463e95926a674fd580daa3a55","tags":["report"]},{"url":"https://github.com/golang/go/commit/3ba9c890b86dc8c3a54c98d32497b7a8012704f9","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7061-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7109-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-24531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-24538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29402","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29404","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41723","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41725","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-24536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24789","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24791","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-34155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-34156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-34158","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-29405","title":"Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T20:19:19.267Z","modified":"2025-01-06T19:44:24.568Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:35:28.643185Z"}],"euvd":[{"id":"EUVD-2023-32976","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T20:19:19Z","modified":"2025-01-06T19:44:24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:25.174818Z"}],"ghsa":[{"id":"GHSA-68g3-2p3g-w9pq","title":"The go command may execute arbitrary code at build time when using cgo. This may occur when...","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T21:30:27Z","modified":"2024-12-06T15:32:21Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74","CWE-88"],"updated_at":"2026-11-02T14:59:04.219575Z"}],"nvd":[{"id":"CVE-2023-29405","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T21:15:17.197Z","modified":"2026-06-17T05:49:58.753Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:08:05.329837Z"}],"osv":[{"id":"ALPINE-CVE-2023-29405","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T21:15:17.197Z","modified":"2026-11-03T06:32:48.381717755Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"AZL-27110","title":"CVE-2023-29405 affecting package golang for versions less than 1.20.7-1","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T21:15:17Z","modified":"2026-04-21T04:24:03.286539Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-27123","title":"CVE-2023-29405 affecting package msft-golang for versions less than 1.20.7-1","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T21:15:17Z","modified":"2026-04-21T04:24:04.067456Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-37347","title":"CVE-2023-29405 affecting package golang for versions less than 1.21.6-1","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T21:15:17Z","modified":"2026-04-21T04:28:16.516718Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-37499","title":"CVE-2023-29405 affecting package golang for versions less than 1.21.6-1","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T21:15:17Z","modified":"2026-04-21T04:28:21.984457Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-52827","title":"CVE-2023-29405 affecting package golang for versions less than 1.20.7-1","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T21:15:17Z","modified":"2026-04-21T04:47:25.065067Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"AZL-79012","title":"CVE-2023-29405 affecting package golang 1.25.7-1","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T21:15:17Z","modified":"2026-04-21T04:34:35.504014Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"AZL-98760","title":"CVE-2023-29405 affecting package golang 1.27.1-1","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T21:15:17Z","modified":"2026-09-16T06:39:01Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BELL-CVE-2023-29405","title":"CVE-2023-29405 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:38.99245Z","modified":"2026-01-26T09:45:51.475464Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-29405","title":"Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T20:19:19.267Z","modified":"2026-10-28T02:30:51.957481803Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"DEBIAN-CVE-2023-29405","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T21:15:17.197Z","modified":"2026-10-26T18:02:13.890448607Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"OESA-2023-1386","title":"golang security update","description":"The Go Programming Language.\r\n\r\nSecurity Fix(es):\r\n\r\nThe go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via \u0026quot;go get\u0026quot;, are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).(CVE-2023-29402)\r\n\r\nThe go command may execute arbitrary code at build time when using cgo. This may occur when running \u0026quot;go get\u0026quot; on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \u0026quot;#cgo LDFLAGS\u0026quot; directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.(CVE-2023-29404)\r\n\r\nThe go command may execute arbitrary code at build time when using cgo. This may occur when running \u0026quot;go get\u0026quot; on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \u0026quot;#cgo LDFLAGS\u0026quot; directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.(CVE-2023-29405)","status":"published","published":"2023-07-01T11:05:51Z","modified":"2026-08-18T01:17:45.280591808Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1499","title":"golang security update","description":"The Go Programming Language.\r\n\r\nSecurity Fix(es):\r\n\r\nThe go command may execute arbitrary code at build time when using cgo. This may occur when running \u0026quot;go get\u0026quot; on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \u0026quot;#cgo LDFLAGS\u0026quot; directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.(CVE-2023-29404)\r\n\r\nThe go command may execute arbitrary code at build time when using cgo. This may occur when running \u0026quot;go get\u0026quot; on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \u0026quot;#cgo LDFLAGS\u0026quot; directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.(CVE-2023-29405)\r\n\r\nThe HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.(CVE-2023-29406)","status":"published","published":"2023-08-12T11:05:57Z","modified":"2026-08-18T01:17:46.891012041Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"RHSA-2023:3920","title":"Red Hat Security Advisory: go-toolset-1.19 and go-toolset-1.19-golang security update","status":"published","published":"2024-09-18T05:00:55Z","modified":"2026-06-26T11:05:29Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3922","title":"Red Hat Security Advisory: go-toolset:rhel8 security update","status":"published","published":"2024-09-18T05:01:05Z","modified":"2026-03-23T04:47:38.108188Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3923","title":"Red Hat Security Advisory: go-toolset and golang security update","status":"published","published":"2024-09-18T05:01:24Z","modified":"2026-03-23T04:49:30.838146Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"UBUNTU-CVE-2023-29405","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T21:15:00Z","modified":"2026-05-20T16:13:34.754327251Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"ALSA-2023:3922","title":"Critical: go-toolset:rhel8 security update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang: cmd/go: go command may generate unexpected code at build time when using cgo (CVE-2023-29402)\n* golang: cmd/go: go command may execute arbitrary code at build time when using cgo (CVE-2023-29404)\n* golang: cmd/cgo: Arbitratry code execution triggered by linker flags (CVE-2023-29405)\n* golang: runtime: unexpected behavior of setuid/setgid binaries (CVE-2023-29403)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-06-29T00:00:00Z","modified":"2026-10-29T11:02:09.342077327Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:3923","title":"Critical: go-toolset and golang security update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nThe golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang: cmd/go: go command may generate unexpected code at build time when using cgo (CVE-2023-29402)\n* golang: cmd/go: go command may execute arbitrary code at build time when using cgo (CVE-2023-29404)\n* golang: cmd/cgo: Arbitratry code execution triggered by linker flags (CVE-2023-29405)\n* golang: runtime: unexpected behavior of setuid/setgid binaries (CVE-2023-29403)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-06-29T00:00:00Z","modified":"2026-10-29T11:31:28.265141347Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"BIT-golang-2023-29405","title":"Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2024-03-06T10:55:15.285Z","modified":"2026-09-08T08:47:49.098443727Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"GO-2023-1842","title":"Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go","description":"The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive.\n\nFlags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.","status":"published","published":"2023-06-08T20:15:53Z","modified":"2026-02-04T02:18:05.247471Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"MGASA-2023-0227","title":"Updated golang packages fix security vulnerability","description":"Code injection via go command with cgo in cmd/go (CVE-2023-29402)\nIgnoring setuid/setgid bits. (CVE-2023-29403)\nArbitrary code execution (CVE-2023-29404)\nArbitrary code execution (CVE-2023-29405)\n","status":"published","published":"2023-07-07T05:54:45Z","modified":"2026-04-16T04:43:51.269405776Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12987-1","title":"go1.19-1.19.10-1.1 on GA media","description":"These are all security issues fixed in the go1.19-1.19.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:10:43.33411Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:12988-1","title":"go1.20-1.20.5-1.1 on GA media","description":"These are all security issues fixed in the go1.20-1.20.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:16:20.297062Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"RLSA-2023:3923","title":"Critical: go-toolset and golang security update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nThe golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang: cmd/go: go command may generate unexpected code at build time when using cgo (CVE-2023-29402)\n\n* golang: cmd/go: go command may execute arbitrary code at build time when using cgo (CVE-2023-29404)\n\n* golang: cmd/cgo: Arbitratry code execution triggered by linker flags (CVE-2023-29405)\n\n* golang: runtime: unexpected behavior of setuid/setgid binaries (CVE-2023-29403)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-07-08T02:54:41.143214Z","modified":"2026-02-04T17:15:13.591435Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2023:2525-1","title":"Security update for go1.19","description":"This update for go1.19 fixes the following issues:\n\nUpdate to go1.19.10 (bsc#1200441):\n\n- CVE-2023-29402: cmd/go: Fixed cgo code injection (bsc#1212073).                                                                                                                              \n- CVE-2023-29403: runtime: Fixed unexpected behavior of setuid/setgid binaries (bsc#1212074).                                                                                                  \n- CVE-2023-29404: cmd/go: Fixed improper sanitization of LDFLAGS (bsc#1212075).                                                                                                                \n- CVE-2023-29405: cmd/go: Fixed improper sanitization of LDFLAGS (bsc#1212076).                                                                                                                \n","status":"published","published":"2023-06-16T15:33:08Z","modified":"2026-02-04T04:08:50.575902Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2526-1","title":"Security update for go1.20","description":"This update for go1.20 fixes the following issues:\n\nUpdate to go1.20.5 (bsc#1206346):\n\n- CVE-2023-29402: cmd/go: Fixed cgo code injection (bsc#1212073).                                                                                                                              \n- CVE-2023-29403: runtime: Fixed unexpected behavior of setuid/setgid binaries (bsc#1212074).                                                                                                  \n- CVE-2023-29404: cmd/go: Fixed improper sanitization of LDFLAGS (bsc#1212075).                                                                                                                \n- CVE-2023-29405: cmd/go: Fixed improper sanitization of LDFLAGS (bsc#1212076).                                                                                                                \n","status":"published","published":"2023-06-16T15:33:41Z","modified":"2026-02-04T03:59:11.699004Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-7061-1","title":"golang-1.17 vulnerabilities","description":"Hunter Wittenborn discovered that Go incorrectly handled the sanitization\nof environment variables. An attacker could possibly use this issue to run\narbitrary commands. (CVE-2023-24531)\n\nSohom Datta discovered that Go did not properly validate backticks (`) as\nJavascript string delimiters, and did not escape them as expected. An\nattacker could possibly use this issue to inject arbitrary Javascript code\ninto the Go template. (CVE-2023-24538)\n\nJuho Nurminen discovered that Go incorrectly handled certain special\ncharacters in directory or file paths. An attacker could possibly use\nthis issue to inject code into the resulting binaries. (CVE-2023-29402)\n\nVincent Dehors discovered that Go incorrectly handled permission bits.\nAn attacker could possibly use this issue to read or write files with\nelevated privileges. (CVE-2023-29403)\n\nJuho Nurminen discovered that Go incorrectly handled certain crafted\narguments. An attacker could possibly use this issue to execute arbitrary\ncode at build time. (CVE-2023-29405)\n\nIt was discovered that Go incorrectly validated the contents of host\nheaders. A remote attacker could possibly use this issue to inject\nadditional headers or entire requests. (CVE-2023-29406)\n\nTakeshi Kaneko discovered that Go did not properly handle comments and\nspecial tags in the script context of html/template module. An attacker\ncould possibly use this issue to inject Javascript code and perform a\ncross-site scripting attack. (CVE-2023-39318, CVE-2023-39319)\n\nIt was discovered that Go did not limit the number of simultaneously\nexecuting handler goroutines in the net/http module. An attacker could\npossibly use this issue to cause a panic resulting in a denial of service.\n(CVE-2023-39325)\n\nIt was discovered that the Go html/template module did not validate errors\nreturned from MarshalJSON methods. An attacker could possibly use this\nissue to inject arbitrary code into the Go template. (CVE-2024-24785)\n","status":"published","published":"2024-10-10T12:55:01Z","modified":"2026-04-27T17:30:53.50497Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7109-1","title":"golang-1.18 vulnerabilities","description":"Philippe Antoine discovered that Go incorrectly handled crafted HTTP/2\nstreams. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2022-41723)\n\nMarten Seemann discovered that Go did not properly manage memory under\ncertain circumstances. An attacker could possibly use this issue to cause\na panic resulting in a denial of service. (CVE-2022-41724)\n\nAmeya Darshan and Jakob Ackermann discovered that Go did not properly\nvalidate the amount of memory and disk files ReadForm can consume. An\nattacker could possibly use this issue to cause a panic resulting in a\ndenial of service. (CVE-2022-41725)\n\nHunter Wittenborn discovered that Go incorrectly handled the sanitization\nof environment variables. An attacker could possibly use this issue to run\narbitrary commands. (CVE-2023-24531)\n\nJakob Ackermann discovered that Go incorrectly handled multipart\nforms. An attacker could possibly use this issue to consume an excessive\namount of resources, resulting in a denial of service. (CVE-2023-24536)\n\nJuho Nurminen discovered that Go incorrectly handled certain special\ncharacters in directory or file paths. An attacker could possibly use\nthis issue to inject code into the resulting binaries. (CVE-2023-29402)\n\nVincent Dehors discovered that Go incorrectly handled permission bits.\nAn attacker could possibly use this issue to read or write files with\nelevated privileges. (CVE-2023-29403)\n\nJuho Nurminen discovered that Go incorrectly handled certain compiler\ndirectives. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2023-29404)\n\nJuho Nurminen discovered that Go incorrectly handled certain crafted\narguments. An attacker could possibly use this issue to execute arbitrary\ncode at build time. (CVE-2023-29405)\n\nBartek Nowotarski discovered that Go incorrectly validated the contents of\nhost headers. A remote attacker could possibly use this issue to inject\nadditional headers or entire requests. (CVE-2023-29406)\n\nTakeshi Kaneko discovered that Go did not properly handle comments and\nspecial tags in the script context of html/template module. An attacker\ncould possibly use this issue to inject Javascript code and perform a\ncross-site scripting attack. (CVE-2023-39318, CVE-2023-39319)\n\nIt was discovered that Go did not properly validate the \"//go:cgo_\"\ndirectives during compilation. An attacker could possibly use this issue\nto inject arbitrary code during compile time. (CVE-2023-39323)\n\nIt was discovered that Go did not limit the number of simultaneously\nexecuting handler goroutines in the net/http module. An attacker could\npossibly use this issue to cause a panic resulting in a denial of service.\n(CVE-2023-39325)\n\nBartek Nowotarski was discovered that the Go net/http module did not\nproperly handle the requests when request's headers exceed MaxHeaderBytes.\nAn attacker could possibly use this issue to cause a panic resulting into\na denial of service. (CVE-2023-45288)\n\nBartek Nowotarski discovered that the Go net/http module did not properly\nvalidate the total size of the parsed form when parsing a multipart form.\nAn attacker could possibly use this issue to cause a panic resulting into a\ndenial of service. (CVE-2023-45290)\n\nJohn Howard discovered that the Go crypto/x509 module did not properly\nhandle a certificate chain which contains a certificate with an unknown\npublic key algorithm. An attacker could possibly use this issue to cause\na panic resulting into a denial of service. (CVE-2024-24783)\n\nJuho Nurminen discovered that the Go net/mail module did not properly\nhandle comments within display names in the ParseAddressList function.\nAn attacker could possibly use this issue to cause a panic resulting into\na denial of service. (CVE-2024-24784)\n\nIt was discovered that the Go html/template module did not validate errors\nreturned from MarshalJSON methods. An attacker could possibly use this\nissue to inject arbitrary code into the Go template. (CVE-2024-24785)\n\nYufan You discovered that the Go archive/zip module did not properly\nhandle certain types of invalid zip files differs from the behavior of\nmost zip implementations. An attacker could possibly use this issue to\ncause a panic resulting into a denial of service. (CVE-2024-24789)\n\nEnze Wang and Jianjun Chen discovered that the Go net/netip module did\nnot work as expected for IPv4-mapped IPv6 addresses in various Is methods.\nAn attacker could possibly use this issue to cause a panic resulting into\na denial of service. (CVE-2024-24790)\n\nGeoff Franks discovered that the Go net/http module did not properly\nhandle responses to requests with an \"Expect: 100-continue\" header under\ncertain circumstances. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2024-24791)\n\nIt was discovered that the Go parser module did not properly handle deeply\nnested literal values. An attacker could possibly use this issue to cause\na panic resulting in a denial of service. (CVE-2024-34155)\n\nMd Sakib Anwar discovered that the Go encoding/gob module did not properly\nhandle message decoding under certain circumstances. An attacker could\npossibly use this issue to cause a panic resulting in a denial of service.\n(CVE-2024-34156)\n\nIt was discovered that the Go build module did not properly handle certain\nbuild tag lines with deeply nested expressions. An attacker could possibly\nuse this issue to cause a panic resulting in a denial of service.\n(CVE-2024-34158)\n","status":"published","published":"2024-11-14T13:57:58Z","modified":"2026-06-25T13:32:29.525356949Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}