TI-2023-13785 CVE-2023-29405 · GHSA-68g3-2p3g-w9pq
Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go
Priority MEDIUM 52
The go command may execute arbitrary code at build time when using cgo.
RHSA-2023:3920
go-toolset-1.19 and go-toolset-1.19-golang security update
Released 2023-06-29 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.19-1.19.10-1.el7_9, go-toolset-1.19-build-1.19.10-1.el7_9, go-toolset-1.19-golang-1.19.10-1.el7_9 +8
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.19-1.19.10-1.el7_9, go-toolset-1.19-build-1.19.10-1.el7_9, go-toolset-1.19-golang-1.19.10-1.el7_9 +8
Fixes 4 records
TI-2023-13784 CVE-2023-29404 · GHSA-888h-rm2r-vrc7
Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go
Priority MEDIUM 52
The go command may execute arbitrary code at build time when using cgo.
TI-2023-13782 CVE-2023-29402 · GHSA-f2cj-5636-4j38
Code injection via go command with cgo in cmd/go
Priority MEDIUM 52
The go command may generate unexpected code at build time when using cgo.
TI-2023-13783 CVE-2023-29403 · GHSA-rxx3-4978-3cc9
Unsafe behavior in setuid/setgid binaries in runtime
Priority LOW 36
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits.