Red Hat Security Advisory

RHSA-2023:3922

go-toolset:rhel8 security update

Released 2023-06-29 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.10-1.module+el8.8.0+19203+782922b7.aarch64::go-toolset:rhel8 +18

TI-2023-13785 CVE-2023-29405 · GHSA-68g3-2p3g-w9pq

MEDIUM 52

The go command may execute arbitrary code at build time when using cgo.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01714 Published 2023-06-08 Partial fix · 1.19.10, 1.20.5 CWE-74

TI-2023-13784 CVE-2023-29404 · GHSA-888h-rm2r-vrc7

MEDIUM 52

The go command may execute arbitrary code at build time when using cgo.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01822 Published 2023-06-08 Partial fix · 1.19.10, 1.20.5 CWE-94

TI-2023-13782 CVE-2023-29402 · GHSA-f2cj-5636-4j38

MEDIUM 52

The go command may generate unexpected code at build time when using cgo.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01694 Published 2023-06-08 Partial fix · 1.19.10, 1.20.5 CWE-94

TI-2023-13783 CVE-2023-29403 · GHSA-rxx3-4978-3cc9

LOW 36

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00429 Published 2023-06-08 Partial fix · 1.19.10, 1.20.5 CWE-668