Logo
›
›vulnerability›CVE-2023-29402
Name
CVE-2023-29402
Source
NVD ( link)Debian ( link)
Description
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
CWEs
CWE-94
Published Date
Updated Date
Workaround
-
Advisories
https://go.dev/cl/501226Patch
https://go.dev/issue/60167Issue Tracking
https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJMailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/Mailing List
https://pkg.go.dev/vuln/GO-2023-1839Vendor Advisory
https://go.dev/cl/501226Patch
https://go.dev/issue/60167Issue Tracking
https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJMailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/Mailing List
https://pkg.go.dev/vuln/GO-2023-1839Vendor Advisory

Analysis#

Affected Component
Analysis
go
Exploitable
go-binary-native
Exploitable

Vulnerability Ratings#

9.8
CVSSv31
9.8
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
golang-bootstrap
openwrt
master
1.24.13-r1
Not Affected
golang1.26
openwrt
master
1.26.4-r1
Not Affected
golang-bootstrap
openwrt
openwrt-25.12
1.24.13-r1
Not Affected
golang1.26
openwrt
openwrt-25.12
1.26.4-r1
Not Affected
go
yocto
master
1.26.4
Not Affected
go-binary-native
yocto
master
1.26.4
Not Affected
go
yocto
scarthgap
1.22.12
Not Affected
go-binary-native
yocto
scarthgap
1.22.12
Not Affected