Summary
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
Security Fix(es):
* golang: cmd/go: go command may generate unexpected code at build time when using cgo (CVE-2023-29402)
* golang: cmd/go: go command may execute arbitrary code at build time when using cgo (CVE-2023-29404)
* golang: cmd/cgo: Arbitratry code execution triggered by linker flags (CVE-2023-29405)
* golang: runtime: unexpected behavior of setuid/setgid binaries (CVE-2023-29403)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | delve | 1.9.1-1.module_el8.8.0+3471+a62632a0 |
| AlmaLinux · 8 | go-toolset | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux · 8 | golang | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux · 8 | golang-bin | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux · 8 | golang-docs | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux · 8 | golang-misc | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux · 8 | golang-race | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux · 8 | golang-src | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux · 8 | golang-tests | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
Vulnerabilities 4
-
Critical 9.8
Code injection via go command with cgo in cmd/go
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in th…
-
Critical 9.8
Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo …
-
Critical 9.8
Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo …
-
High 7.8
Unsafe behavior in setuid/setgid binaries in runtime
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/set…
References
-
report
https://access.redhat.com/security/cve/CVE-2023-29402
-
report
https://access.redhat.com/security/cve/CVE-2023-29403
-
report
https://access.redhat.com/security/cve/CVE-2023-29404
-
report
https://access.redhat.com/security/cve/CVE-2023-29405
-
report
https://bugzilla.redhat.com/2216965
-
report
https://bugzilla.redhat.com/2217562
-
report
https://bugzilla.redhat.com/2217565
-
report
https://bugzilla.redhat.com/2217569
-
advisory
https://errata.almalinux.org/8/ALSA-2023-3922.html