Bug 2217562 (CVE-2023-29402) - CVE-2023-29402 golang: cmd/go: go command may generate unexpected code at build time when using cgo
Summary: CVE-2023-29402 golang: cmd/go: go command may generate unexpected code at bui...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-29402
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2217563 2217564 2217575 2217576 2217577 2217578 2217579 2217580 2217581 2217582 2217583 2217584 2217585 2217586 2217587
Blocks: 2217573
TreeView+ depends on / blocked
 
Reported: 2023-06-26 17:50 UTC by Pedro Sampaio
Modified: 2024-03-19 10:20 UTC (History)
16 users (show)

Fixed In Version: go 1.20.5, go 1.19.10
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in golang. The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program that uses cgo. This can occur when running an untrusted module that contains directories with newline characters in their names. Modules that are retrieved using the go command, for example, via "go get", are not affected. Modules retrieved using GOPATH-mode, for example, GO111MODULE=off may be affected.
Clone Of:
Environment:
Last Closed: 2023-06-29 14:17:40 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2023:3940 0 None None None 2023-06-29 13:45:51 UTC
Red Hat Product Errata RHBA-2023:3941 0 None None None 2023-06-29 14:13:27 UTC
Red Hat Product Errata RHBA-2023:3956 0 None None None 2023-06-30 02:50:33 UTC
Red Hat Product Errata RHSA-2023:3920 0 None None None 2023-06-29 05:30:55 UTC
Red Hat Product Errata RHSA-2023:3922 0 None None None 2023-06-29 09:07:24 UTC
Red Hat Product Errata RHSA-2023:3923 0 None None None 2023-06-29 09:45:25 UTC

Description Pedro Sampaio 2023-06-26 17:50:38 UTC 
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).

https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
https://pkg.go.dev/vuln/GO-2023-1839
https://go.dev/issue/60167
https://go.dev/cl/501226
Comment 1 Pedro Sampaio 2023-06-26 17:51:32 UTC 
Created golang tracking bugs for this issue:

Affects: epel-all [bug 2217563]
Affects: fedora-all [bug 2217564]
Comment 3 errata-xmlrpc 2023-06-29 05:30:53 UTC 
This issue has been addressed in the following products:

  Red Hat Developer Tools

Via RHSA-2023:3920 https://access.redhat.com/errata/RHSA-2023:3920
Comment 4 errata-xmlrpc 2023-06-29 09:07:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:3922 https://access.redhat.com/errata/RHSA-2023:3922
Comment 5 errata-xmlrpc 2023-06-29 09:45:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:3923 https://access.redhat.com/errata/RHSA-2023:3923
Comment 6 Product Security DevOps Team 2023-06-29 14:17:36 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-29402
Note You need to log in before you can comment on or make changes to this bug.