CVE-2023-39320 Arbitrary code execution via go.mod toolchain directive in cmd/go

🗓️ 08 Sep 2023 16:13:26Reported by GoType

Arbitrary code execution via go.mod toolchain directiv

Reporter	Title	Published	Views	Family All 72
IBM Security Bulletins	Security Bulletin: Operations Dashboard is vulnerable to remote code execution due to Go	15 Nov 202313:35	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js, Golang Go, HTTP/2, NGINX, OpenSSH, Linux kernel might affect IBM Spectrum Protect Plus	4 Feb 202518:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go	5 Jun 202420:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift	15 Apr 202502:37	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to code injection and privilege escalation due to multiple vulnerabilities in Go	30 Oct 202316:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data Scheduling contains a vulnerable yq package. [CVE-2023-39320, CVE-2023-39321 and CVE-2023-39322]	18 Mar 202414:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak for Multicloud Management	25 Sep 202417:28	–	ibm
AlpineLinux	CVE-2023-39320	8 Sep 202316:13	–	alpinelinux
BDU FSTEC	The vulnerability of the go.mod file in the Go programming language allows a hacker to elevate their privileges and execute arbitrary code.	16 Sep 202300:00	–	bdu_fstec
FreeBSD	go -- multiple vulnerabilities	6 Sep 202300:00	–	freebsd

[
  {
    "vendor": "Go toolchain",
    "product": "cmd/go",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "cmd/go",
    "versions": [
      {
        "version": "1.21.0-0",
        "lessThan": "1.21.1",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
go	www.go.dev/cl/526158
security	www.security.gentoo.org/glsa/202311-09
pkg	www.pkg.go.dev/vuln/GO-2023-2042
security	www.security.netapp.com/advisory/ntap-20231020-0004/
go	www.go.dev/issue/62198
groups	www.groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ

25 Nov 2023 11:10Current

9.8High risk

Vulners AI Score9.8

EPSS0.00798