Red Hat Security Advisory

RHSA-2023:3923

go-toolset and golang security update

Released 2023-06-29 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.19.10-1.el9_2, golang-1.19.10-1.el9_2, golang-bin-1.19.10-1.el9_2 +5

TI-2023-13785 CVE-2023-29405 · GHSA-68g3-2p3g-w9pq

MEDIUM 52

The go command may execute arbitrary code at build time when using cgo.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01714 Published 2023-06-08 Partial fix · 1.19.10, 1.20.5 CWE-74

TI-2023-13784 CVE-2023-29404 · GHSA-888h-rm2r-vrc7

MEDIUM 52

The go command may execute arbitrary code at build time when using cgo.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01822 Published 2023-06-08 Partial fix · 1.19.10, 1.20.5 CWE-94

TI-2023-13782 CVE-2023-29402 · GHSA-f2cj-5636-4j38

MEDIUM 52

The go command may generate unexpected code at build time when using cgo.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01694 Published 2023-06-08 Partial fix · 1.19.10, 1.20.5 CWE-94

TI-2023-13783 CVE-2023-29403 · GHSA-rxx3-4978-3cc9

LOW 36

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00429 Published 2023-06-08 Partial fix · 1.19.10, 1.20.5 CWE-668