Lucene search

K
osvGoogleOSV:CVE-2023-29402
HistoryJun 08, 2023 - 9:15 p.m.

CVE-2023-29402

2023-06-0821:15:16
Google
osv.dev
14
go command
build time
cgo
unexpected code
unexpected behavior
untrusted module
newline characters
module retrieval
go get
gopath-mode
software

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.0%

The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via โ€œgo getโ€, are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.0%