Golang Go: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 4

• Critical 9.8
  CVE-2023-29402

  Code injection via go command with cgo in cmd/go

  The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in th…

  Go toolchain cmd/go katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 8, 2023
• Critical 9.8
  CVE-2023-29404

  Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go

  The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo …

  Go toolchain cmd/go katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 8, 2023
• Critical 9.8
  CVE-2023-29405

  Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go

  The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo …

  Go toolchain cmd/go cmd/cgo katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 8, 2023
• High 7.8
  CVE-2023-29403

  Unsafe behavior in setuid/setgid binaries in runtime

  On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/set…

  Go standard library runtime katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 8, 2023

Revision history

1. 2024-11-14 #20

   Neue Updates von Ubuntu aufgenommen

2. 2024-10-10 #19

   Neue Updates von Ubuntu aufgenommen

3. 2024-06-25 #18

   Neue Updates von Red Hat aufgenommen

4. 2024-01-22 #17

   Neue Updates von Splunk-SVD aufgenommen

5. 2023-11-26 #16

   Neue Updates von Gentoo aufgenommen

6. 2023-10-10 #15

   Neue Updates von IBM aufgenommen

7. 2023-10-08 #14

   Neue Updates von Amazon aufgenommen

8. 2023-09-27 #13

   Neue Updates von Amazon aufgenommen

9. 2023-08-09 #12

   Neue Updates von Amazon aufgenommen

10. 2023-08-02 #11

    Neue Updates von Fedora aufgenommen

11. 2023-07-25 #10

    Neue Updates von Amazon aufgenommen

12. 2023-07-20 #9

    Neue Updates von Amazon aufgenommen

13. 2023-07-19 #8

    Neue Updates von Amazon aufgenommen

14. 2023-07-17 #7

    Neue Updates von Fedora aufgenommen

15. 2023-07-09 #6

    Neue Updates von Oracle Linux aufgenommen

16. 2023-07-04 #5

    Neue Updates von Oracle Linux aufgenommen

17. 2023-06-29 #4

    Neue Updates von Fedora und Red Hat aufgenommen

18. 2023-06-28 #3

    Neue Updates von Red Hat aufgenommen

19. 2023-06-18 #2

    Neue Updates von SUSE aufgenommen

20. 2023-06-06 #1

    Initiale Fassung

References

• Github golang vom 2023-06-06
  https://go.dev/issue/60167
• Github golang vom 2023-06-06
  https://go.dev/issue/60272
• Github golang vom 2023-06-06
  https://go.dev/issue/60305
• Github golang vom 2023-06-06
  https://go.dev/issue/60306
• Github golang vom 2023-06-06
  https://groups.google.com/g/golang-announce/c/1AItFMBjrfw
• SUSE Security Update SUSE-SU-2023:2526-1 vom 2023-06-16
  https://lists.suse.com/pipermail/sle-security-updates/2023-June/015222.html
• SUSE Security Update SUSE-SU-2023:2525-1 vom 2023-06-16
  https://lists.suse.com/pipermail/sle-security-updates/2023-June/015223.html
• SUSE Security Update SUSE-SU-2023:2526-1 vom 2023-06-17
  https://lists.suse.com/pipermail/sle-security-updates/2023-June/015225.html
• Red Hat Security Advisory RHSA-2023:3922 vom 2023-06-29
  https://access.redhat.com/errata/RHSA-2023:3922
• Red Hat Security Advisory RHSA-2023:3920 vom 2023-06-29
  https://access.redhat.com/errata/RHSA-2023:3920
• Fedora Security Advisory FEDORA-EPEL-2023-560BC00F33 vom 2023-06-30
  https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-560bc00f33
• Red Hat Security Advisory RHSA-2023:3923 vom 2023-06-29
  https://access.redhat.com/errata/RHSA-2023:3923
• Oracle Linux Security Advisory ELSA-2023-3922 vom 2023-07-04
  https://linux.oracle.com/errata/ELSA-2023-3922.html
• Oracle Linux Security Advisory ELSA-2023-3923 vom 2023-07-07
  https://linux.oracle.com/errata/ELSA-2023-3923.html
• Fedora Security Advisory FEDORA-2023-EB60FCD505 vom 2023-07-17
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-eb60fcd505
• Fedora Security Advisory FEDORA-2023-8A135F6AA7 vom 2023-07-17
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-8a135f6aa7
• Amazon Linux Security Advisory ALAS-2023-1784 vom 2023-07-20
  https://alas.aws.amazon.com/ALAS-2023-1784.html
• Amazon Linux Security Advisory ALAS-2023-2131 vom 2023-07-20
  https://alas.aws.amazon.com/AL2/ALAS-2023-2131.html
• Amazon Linux Security Advisory ALAS2-2023-2163 vom 2023-07-26
  https://alas.aws.amazon.com/AL2/ALAS-2023-2163.html
• Fedora Security Advisory FEDORA-2023-1819DC9854 vom 2023-08-02
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-1819dc9854
• IBM Security Bulletin 7011697 vom 2023-08-03
  https://www.cybersecurity-help.cz/vdb/SB2023080304
• Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2023-026 vom 2023-08-10
  https://alas.aws.amazon.com/AL2/ALASNITRO-ENCLAVES-2023-026.html
• Amazon Linux Security Advisory ALASGOLANG1.19-2023-001 vom 2023-09-28
  https://alas.aws.amazon.com/AL2/ALASGOLANG1.19-2023-001.html
• Amazon Linux Security Advisory ALAS-2023-1848 vom 2023-10-06
  https://alas.aws.amazon.com/ALAS-2023-1848.html
• IBM Security Bulletin 7049434 vom 2023-10-11
  https://www.ibm.com/support/pages/node/7049434
• Splunk Security Advisory SVD-2024-0109 vom 2024-01-22
  https://advisory.splunk.com//advisories/SVD-2024-0109
• IBM Security Bulletin 7096482 vom 2024-01-22
  https://www.ibm.com/support/pages/node/7096482
• Gentoo Linux Security Advisory GLSA-202311-09 vom 2023-11-25
  https://security.gentoo.org/glsa/202311-09
• Red Hat Security Advisory RHSA-2024:4119 vom 2024-06-26
  https://access.redhat.com/errata/RHSA-2024:4119
• Ubuntu Security Notice USN-7061-1 vom 2024-10-10
  https://ubuntu.com/security/notices/USN-7061-1
• Ubuntu Security Notice USN-7109-1 vom 2024-11-14
  https://ubuntu.com/security/notices/USN-7109-1