The vulnerability of the Go programming language lies in the improper elimination of special elements in the output data, allowing attackers to set arbitrary environment variables in Windows.

🗓️ 23 Jan 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Go flaw from improper elimination of special output elements enables Windows variable abuse.

Reporter	Title	Published	Views	Family All 131
IBM Security Bulletins	Security Bulletin: CVE-2022-2879, CVE-2022-41715, CVE-2022-2880, CVE-2022-41717, CVE-2022-41716 may affect IBM CICS TX Advanced	16 Mar 202315:24	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for Febuary 2023	10 Mar 202318:29	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Pypa Setuptools, Golang Go, OpenSSH, Minio and Certifi may affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift	26 Mar 202503:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® REST	17 Apr 202318:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is affected by multiple vulnerabilities in Golang Go	5 Jul 202321:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.	26 Apr 202319:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.	12 Apr 202320:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Golang Go (CVE-2022-41716)	31 Mar 202317:09	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	24 Feb 202319:49	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.9 addresses multiple security vulnerabilities.	18 Jul 202313:09	–	ibm

Vulners

Node

go goRange<1.18.8

OR

go goRange1.19–1.19.3

Source	Link
go	www.go.dev/cl/446916
go	www.go.dev/issue/56284
groups	www.groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ
pkg	www.pkg.go.dev/vuln/GO-2022-1095
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-41716
web	www.web.nvd.nist.gov/view/vuln/detail

23 Jan 2023 00:00Current

7High risk

Vulners AI Score7

CVSS 37.5

CVSS 27.8

EPSS0.00778

Go vulnerability special output elements environment variables Windows remote installation