Vulnerability Description
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Golang | Go | < 1.19.10 |
| Fedoraproject | Fedora | 38 |
Related Weaknesses (CWE)
References
- https://go.dev/cl/501226Patch
- https://go.dev/issue/60167Issue Tracking
- https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJMailing ListRelease Notes
- https://lists.fedoraproject.org/archives/list/[email protected]
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing List
- https://pkg.go.dev/vuln/GO-2023-1839Vendor Advisory
- https://security.gentoo.org/glsa/202311-09
- https://go.dev/cl/501226Patch
- https://go.dev/issue/60167Issue Tracking
- https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJMailing ListRelease Notes
- https://lists.fedoraproject.org/archives/list/[email protected]
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing List
- https://pkg.go.dev/vuln/GO-2023-1839Vendor Advisory
- https://security.gentoo.org/glsa/202311-09
- https://security.netapp.com/advisory/ntap-20241213-0004/
FAQ
What is CVE-2023-29402?
CVE-2023-29402 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted modu...
How severe is CVE-2023-29402?
CVE-2023-29402 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-29402?
Check the references section above for vendor advisories and patch information. Affected products include: Golang Go, Fedoraproject Fedora.