Read the docs
TI-2020-17204 Aliases CVE-2020-28366GHSA-mwfg-6wv9-379f

Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

Priority LOW 37CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 5 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-94.

Summary

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

Why it matters now

EPSS 0.02342 83rd percentileScored 2026-11-07
Fix Partial cmd/go (Go toolchain): 1.14.12, 1.15.5cmd/cgo (Go toolchain): 1.14.12, 1.15.5Red Hat: 4 advisoriesRed Hat: 5 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarycmd/gobefore 1.14.12; 1.15.0-0 to before 1.15.51.14.12, 1.15.5Patch availableCNA
Go standard librarycmd/cgobefore 1.14.12; 1.15.0-0 to before 1.15.51.14.12, 1.15.5Patch availableCNA
  • cmd/go VendorGo standard library Affected before 1.14.12; 1.15.0-0 to before 1.15.5 Fixed in 1.14.12, 1.15.5 Patch available CNA
  • cmd/cgo VendorGo standard library Affected before 1.14.12; 1.15.0-0 to before 1.15.5 Fixed in 1.14.12, 1.15.5 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.14.12; 1.15 to before 1.15.5VulnerableGo standard library
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:trident:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.14.12; 1.15 to before 1.15.5 Vulnerable ·Go standard library
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:trident:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · CNA cmd/go (Go toolchain) Fixed in 1.14.12, 1.15.5
  • Fix · CNA cmd/cgo (Go toolchain) Fixed in 1.14.12, 1.15.5

Red Hat 4 advisories

  • RHSA-2021:0146 Released 2021-01-14 · Red Hat rating Moderate
    Release of OpenShift Serverless 1.12.0
    • Openshift Serverless 1.12 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8, openshift-serverless-1/eventing-controller-rhel8 +23
  • RHSA-2021:0145 Released 2021-01-14 · Red Hat rating Moderate
    Red Hat OpenShift Serverless Client kn 1.12.0
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-0.18.4-2.el8
  • RHSA-2020:5493 Released 2020-12-15 · Red Hat rating Moderate
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.4.1-1.module+el8.3.0+7840+63dfb1ed.src::go-toolset:rhel8, delve-1.4.1-1.module+el8.3.0+7840+63dfb1ed.x86_64::go-toolset:rhel8, go-toolset-1.14.12-1.module+el8.3.0+8784+380394dc.aarch64::go-toolset:rhel8 +18
Show 1 more Red Hat advisories
  • RHSA-2020:5333 Released 2020-12-03 · Red Hat rating Moderate
    go-toolset-1.14-golang security update
    • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.14-1.14.12-1.el7_9, go-toolset-1.14-build-1.14.12-1.el7_9, go-toolset-1.14-golang-1.14.12-1.el7_9 +7
    • Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.14-1.14.12-1.el7_9, go-toolset-1.14-build-1.14.12-1.el7_9, go-toolset-1.14-golang-1.14.12-1.el7_9 +7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Go toolchain cmd/go 1.14.12, 1.15.5

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2020-17205 Arbitrary code execution via the go command with cgo in cmd/goPriority LOW 37
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift ServerlessAffectedNo fix yet
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Storage 3AffectedNo fix planned: Will not fix
Openshift Serverless 1.12Fixed RHSA-2021:0146
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:5333
Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:5333
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:5493
Red Hat OpenShift Serverless 1.0Fixed RHSA-2021:0145
Not affected: 10 products
  • Distributed Tracing Jaeger 1
  • OpenShift Service Mesh 1
  • OpenShift Service Mesh 2.0
  • Red Hat Ceph Storage 3
  • Red Hat Ceph Storage 4
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Virtualization 2
  • Red Hat Openshift Container Storage 4
  • Red Hat Storage 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-28366
  2. 2026-10-03 Alias added: GHSA-mwfg-6wv9-379f

References

Other 5

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences