Bug 2217562 (CVE-2023-29402)

Summary:	CVE-2023-29402 golang: cmd/go: go command may generate unexpected code at build time when using cgo
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amctagga, aoconnor, asm, bniver, bodavis, dbenoit, emachado, flucifre, gmeno, mbenjamin, mhackett, mnewsome, sipoyare, sostapov, tstellar, vereddy
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	go 1.20.5, go 1.19.10	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in golang. The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program that uses cgo. This can occur when running an untrusted module that contains directories with newline characters in their names. Modules that are retrieved using the go command, for example, via "go get", are not affected. Modules retrieved using GOPATH-mode, for example, GO111MODULE=off may be affected.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-06-29 14:17:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2217563, 2217564, 2217575, 2217576, 2217577, 2217578, 2217579, 2217580, 2217581, 2217582, 2217583, 2217584, 2217585, 2217586, 2217587
Bug Blocks:	2217573

Description Pedro Sampaio 2023-06-26 17:50:38 UTC

The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).

https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
https://pkg.go.dev/vuln/GO-2023-1839
https://go.dev/issue/60167
https://go.dev/cl/501226

Comment 1 Pedro Sampaio 2023-06-26 17:51:32 UTC

Created golang tracking bugs for this issue:

Affects: epel-all [bug 2217563]
Affects: fedora-all [bug 2217564]

Comment 3 errata-xmlrpc 2023-06-29 05:30:53 UTC

This issue has been addressed in the following products:

  Red Hat Developer Tools

Via RHSA-2023:3920 https://access.redhat.com/errata/RHSA-2023:3920

Comment 4 errata-xmlrpc 2023-06-29 09:07:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:3922 https://access.redhat.com/errata/RHSA-2023:3922

Comment 5 errata-xmlrpc 2023-06-29 09:45:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:3923 https://access.redhat.com/errata/RHSA-2023:3923

Comment 6 Product Security DevOps Team 2023-06-29 14:17:36 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-29402