Unscored RHSA-2020:5333 3 CVEs

Red Hat Security Advisory: go-toolset-1.14-golang security update

Published Sep 18, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 10

Release	Package	Fixed in
Red Hat · Devtools 2020 devtools:2020	go-toolset-1.14	0:1.14.12-1.el7_9
Red Hat · Devtools 2020 devtools:2020	go-toolset-1.14-build	0:1.14.12-1.el7_9
Red Hat · Devtools 2020 devtools:2020	go-toolset-1.14-golang	0:1.14.12-1.el7_9
Red Hat · Devtools 2020 devtools:2020	go-toolset-1.14-golang-bin	0:1.14.12-1.el7_9
Red Hat · Devtools 2020 devtools:2020	go-toolset-1.14-golang-docs	0:1.14.12-1.el7_9
Red Hat · Devtools 2020 devtools:2020	go-toolset-1.14-golang-misc	0:1.14.12-1.el7_9
Red Hat · Devtools 2020 devtools:2020	go-toolset-1.14-golang-race	0:1.14.12-1.el7_9
Red Hat · Devtools 2020 devtools:2020	go-toolset-1.14-golang-src	0:1.14.12-1.el7_9
Red Hat · Devtools 2020 devtools:2020	go-toolset-1.14-golang-tests	0:1.14.12-1.el7_9
Red Hat · Devtools 2020 devtools:2020	go-toolset-1.14-runtime	0:1.14.12-1.el7_9

Vulnerabilities 3

Unscored —

CVE-2020-28362

Panic during division of very large numbers in math/big

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

golang go stdlib golang-1.14 Debian Ubuntu Azure Linux Alpine Go

Nov 18, 2020
Unscored —

CVE-2020-28366

Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

Go toolchain cmd/go cmd/cgo go Debian Ubuntu Azure Linux Alpine Go

Nov 18, 2020
Unscored —

CVE-2020-28367

Arbitrary code execution via the go command with cgo in cmd/go

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

Go toolchain cmd/go go golang-1.8 Debian Ubuntu Alpine Go

Nov 18, 2020

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_go_1.14.7_toolset
report
https://bugzilla.redhat.com/show_bug.cgi?id=1897635
report
https://bugzilla.redhat.com/show_bug.cgi?id=1897643
report
https://bugzilla.redhat.com/show_bug.cgi?id=1897646
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5333.json
report
https://access.redhat.com/security/cve/CVE-2020-28362
advisory
https://www.cve.org/CVERecord?id=CVE-2020-28362
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-28362
report
https://access.redhat.com/security/cve/CVE-2020-28366
advisory
https://www.cve.org/CVERecord?id=CVE-2020-28366
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-28366
article
https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM/m/fLguyiM2CAAJ
report
https://access.redhat.com/security/cve/CVE-2020-28367
advisory
https://www.cve.org/CVERecord?id=CVE-2020-28367
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-28367