CVE-2020-28366 Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo
HighCVSS 7.5
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ubuntu/golang-1.13(Ubuntu:22.04) | All versions | No fix listed |
| toolchain(Go) | < 1.14.12 | 1.14.12 |
| toolchain(Go) | >= 1.15.0-0, < 1.15.5 | 1.15.5 |
| debian/golang-1.15(Debian:11) | < 1.15.5-1 | 1.15.5-1 |
| golang go | < 1.14.12 | 1.14.12 |
| golang go | >= 1.15, < 1.15.5 | 1.15.5 |
| fedoraproject fedora | = 32 | No fix listed |
| fedoraproject fedora | = 33 | No fix listed |
| netapp cloud insights telegraf agent | All versions | No fix listed |
| netapp Trident | All versions | No fix listed |
| alpine/go(Alpine:v3.13) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.14) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.15) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.16) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.17) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.18) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.19) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.20) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.21) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.22) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.23) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| alpine/go(Alpine:v3.24) | >= 1.15, < 1.15.5-r0 | 1.15.5-r0 |
| cmd/go(Go) | < 1.14.12 | 1.14.12 |
| cmd/go(Go) | >= 1.15.0-0, < 1.15.5 | 1.15.5 |
| cmd/cgo(Go) | < 1.14.12 | 1.14.12 |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| cmd/cgo(Go) | >= 1.15.0-0, < 1.15.5 | 1.15.5 |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- go.dev patch
- go.googlesource.com patch
- go.dev issue-tracking
- groups.google.com
- security-tracker.debian.org vendor-advisory
- pkg.go.dev
- security.alpinelinux.org vendor-advisory