CVE-2020-28366
Fixed in a distro release EPSS 2%
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
Products: Go toolchain cmd/go, Go toolchain cmd/cgo
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | toolchain | 1.14.12 |
| Go | toolchain | 1.15.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | golang | 1.15.5-1.amzn2.0.2 |
| Amazon Linux 2 | golang-bin | 1.15.5-1.amzn2.0.2 |
| Amazon Linux 2 | golang-docs | 1.15.5-1.amzn2.0.2 |
| Amazon Linux 2 | golang-misc | 1.15.5-1.amzn2.0.2 |
| Amazon Linux 2 | golang-race | 1.15.5-1.amzn2.0.2 |
| Amazon Linux 2 | golang-src | 1.15.5-1.amzn2.0.2 |
| Amazon Linux 2 | golang-tests | 1.15.5-1.amzn2.0.2 |
| Arch Linux | go | 2:1.15.5-1 |
| Debian 11 | golang-1.15 | 1.15.5-1 |
| Red Hat devtools 2020 | go-toolset-1.14 | 0:1.14.12-1.el7_9 |
| Red Hat devtools 2020 | go-toolset-1.14-build | 0:1.14.12-1.el7_9 |
| Red Hat devtools 2020 | go-toolset-1.14-golang | 0:1.14.12-1.el7_9 |
| Red Hat devtools 2020 | go-toolset-1.14-golang-bin | 0:1.14.12-1.el7_9 |
| Red Hat devtools 2020 | go-toolset-1.14-golang-docs | 0:1.14.12-1.el7_9 |
| Red Hat devtools 2020 | go-toolset-1.14-golang-misc | 0:1.14.12-1.el7_9 |
| Red Hat devtools 2020 | go-toolset-1.14-golang-race | 0:1.14.12-1.el7_9 |
| Red Hat devtools 2020 | go-toolset-1.14-golang-src | 0:1.14.12-1.el7_9 |
| Red Hat devtools 2020 | go-toolset-1.14-golang-tests | 0:1.14.12-1.el7_9 |
| Red Hat devtools 2020 | go-toolset-1.14-runtime | 0:1.14.12-1.el7_9 |
| Red Hat Enterprise Linux 8 | delve | 0:1.4.1-1.module+el8.3.0+7840+63dfb1ed |
| Red Hat Enterprise Linux 8 | delve-debuginfo | 0:1.4.1-1.module+el8.3.0+7840+63dfb1ed |
| Red Hat Enterprise Linux 8 | delve-debugsource | 0:1.4.1-1.module+el8.3.0+7840+63dfb1ed |
| Red Hat Enterprise Linux 8 | go-toolset | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat Enterprise Linux 8 | golang | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat Enterprise Linux 8 | golang-bin | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat Enterprise Linux 8 | golang-docs | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat Enterprise Linux 8 | golang-misc | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat Enterprise Linux 8 | golang-race | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat Enterprise Linux 8 | golang-src | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat Enterprise Linux 8 | golang-tests | 0:1.14.12-1.module+el8.3.0+8784+380394dc |
| Red Hat serverless 1.0 | openshift-serverless-clients | 0:0.18.4-2.el8 |
| SUSE Linux Enterprise Module for Development Tools 15 SP1 | go1.14 | 1.14.12-1.26.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP1 | go1.15 | 1.15.5-1.11.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | go1.14 | 1.14.12-1.26.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | go1.15 | 1.15.5-1.11.1 |
| Ubuntu 14.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.6 | no fix |
| Ubuntu 18.04 LTS | golang-1.10 | no fix |
| Ubuntu 18.04 LTS | golang-1.8 | no fix |
| Ubuntu 18.04 LTS | golang-1.9 | no fix |
| Ubuntu 20.04 LTS | golang-1.13 | no fix |
| Ubuntu 20.04 LTS | golang-1.14 | no fix |
| Ubuntu Pro 16.04 LTS | golang-1.13 | no fix |
| Ubuntu Pro 18.04 LTS | golang-1.13 | no fix |
| Ubuntu Pro 22.04 LTS | golang-1.13 | no fix |
| openSUSE Leap 15.1 | go1.14 | 1.14.12-lp151.22.1 |
| openSUSE Leap 15.2 | go1.14 | 1.14.12-lp152.2.12.1 |
| openSUSE Leap 15.2 | go1.15 | 1.15.5-lp152.2.1 |
| openSUSE Tumbleweed | go1.14 | 1.14.15-1.6 |
| openSUSE Tumbleweed | go1.15 | 1.15.15-1.2 |