Lucene search

GoCVE-2020-28367

HistoryNov 18, 2020 - 5:15 p.m.

CVE-2020-28367

2020-11-1817:15:12

CWE-94

web.nvd.nist.gov

284

cve-2020-28367

code injection

go command

cgo

arbitrary code execution

gcc flags

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.016

Percentile

87.8%

JSON

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

Affected configurations

Nvd

Node

golanggoRange<1.14.12

golanggoRange1.15–1.15.5

CNA Affected

[
  {
    "vendor": "Go toolchain",
    "product": "cmd/go",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "cmd/go",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.14.12",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.15.0-0",
        "lessThan": "1.15.5",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "validCompilerFlags"
      }
    ],
    "defaultStatus": "unaffected"
  }
]