Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-68119: cmd/go: unexpected code execution when invoking toolchain CVE-2025-61731: cmd/go: bypass of flag sanitization can lead to arbitrary code execution
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | amazon-ssm-agent | 0:3.3.3883.0-1.amzn2 |
Vulnerabilities 2
-
High 7.8
Arbitrary file write using cgo pkg-config directive in cmd/go
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config com…
-
High 7.0
Unexpected code execution when invoking toolchain in cmd/go
Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how exter…