CVE-2023-29402: Code injection via go command with cgo in cmd/go
Code injection via go command with cgo in cmd/go
Other sources
Golang Go could allow a remote attacker to execute arbitrary code on the system, caused by the generation of unexpected code at build time when using cgo. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-29402?
CVE-2023-29402 is a vulnerability in the go command that may generate unexpected code at build time when using cgo, resulting in unexpected behavior when running a go program.
How does CVE-2023-29402 impact go programs?
CVE-2023-29402 may cause unexpected behavior in go programs that use cgo.
Which versions of Go are affected by CVE-2023-29402?
Go versions up to 1.19.10 and versions 1.20.0 to 1.20.5 are affected by CVE-2023-29402.
Are there any known fixes for CVE-2023-29402?
Applying the latest security updates for Go is recommended to mitigate CVE-2023-29402.
Where can I find more information about CVE-2023-29402?
You can find more information about CVE-2023-29402 on the following links: [link1](https://go.dev/cl/501226), [link2](https://go.dev/issue/60167), [link3](https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ).