CVE-2021-3115
Fixed in a distro release EPSS 7%
Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).
Products: golang go, fedoraproject fedora, netapp cloud_insights_telegraf_agent, netapp storagegrid
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | toolchain | 1.14.14 |
| Go | toolchain | 1.15.7 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | golang | 1.15.8-1.amzn2.0.1 |
| Amazon Linux 2 | golang-bin | 1.15.8-1.amzn2.0.1 |
| Amazon Linux 2 | golang-docs | 1.15.8-1.amzn2.0.1 |
| Amazon Linux 2 | golang-misc | 1.15.8-1.amzn2.0.1 |
| Amazon Linux 2 | golang-race | 1.15.8-1.amzn2.0.1 |
| Amazon Linux 2 | golang-src | 1.15.8-1.amzn2.0.1 |
| Amazon Linux 2 | golang-tests | 1.15.8-1.amzn2.0.1 |
| Arch Linux | go | 2:1.15.7-1 |
| Debian 11 | golang-1.15 | 1.15.7-1 |
| Red Hat Enterprise Linux 8 | delve | 0:1.5.0-2.module+el8.4.0+8864+58b0fcdb |
| Red Hat Enterprise Linux 8 | delve-debuginfo | 0:1.5.0-2.module+el8.4.0+8864+58b0fcdb |
| Red Hat Enterprise Linux 8 | delve-debugsource | 0:1.5.0-2.module+el8.4.0+8864+58b0fcdb |
| Red Hat Enterprise Linux 8 | go-toolset | 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24 |
| Red Hat Enterprise Linux 8 | golang | 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24 |
| Red Hat Enterprise Linux 8 | golang-bin | 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24 |
| Red Hat Enterprise Linux 8 | golang-docs | 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24 |
| Red Hat Enterprise Linux 8 | golang-misc | 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24 |
| Red Hat Enterprise Linux 8 | golang-race | 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24 |
| Red Hat Enterprise Linux 8 | golang-src | 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24 |
| Red Hat Enterprise Linux 8 | golang-tests | 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24 |
| Red Hat serverless 1.0 | openshift-serverless-clients | 0:0.20.0-7.el8 |
| Red Hat serverless 1.0 | openshift-serverless-clients | 0:0.20.0-6.el8 |
| Rocky Linux 8 | delve | 0:1.5.0-2.module+el8.4.0+396+d2d16ae3 |
| Rocky Linux 8 | go-toolset | 0:1.15.7-1.module+el8.4.0+396+d2d16ae3 |
| Rocky Linux 8 | golang | 0:1.15.7-1.module+el8.4.0+396+d2d16ae3 |
| SUSE Enterprise Storage 6 | go1.14 | 1.14.14-1.32.1 |
| SUSE Enterprise Storage 6 | go1.15 | 1.15.7-1.17.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | go1.14 | 1.14.14-1.32.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | go1.15 | 1.15.7-1.17.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | go1.14 | 1.14.14-1.32.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | go1.15 | 1.15.7-1.17.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | go1.14 | 1.14.14-1.32.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | go1.15 | 1.15.7-1.17.1 |
| SUSE Linux Enterprise Server 15 SP1-BCL | go1.14 | 1.14.14-1.32.1 |
| SUSE Linux Enterprise Server 15 SP1-BCL | go1.15 | 1.15.7-1.17.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | go1.14 | 1.14.14-1.32.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | go1.15 | 1.15.7-1.17.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | go1.14 | 1.14.14-1.32.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | go1.15 | 1.15.7-1.17.1 |
| SUSE Manager Proxy 4.0 | go1.14 | 1.14.14-1.32.1 |
| SUSE Manager Proxy 4.0 | go1.15 | 1.15.7-1.17.1 |
| SUSE Manager Retail Branch Server 4.0 | go1.14 | 1.14.14-1.32.1 |
| SUSE Manager Retail Branch Server 4.0 | go1.15 | 1.15.7-1.17.1 |
| SUSE Manager Server 4.0 | go1.14 | 1.14.14-1.32.1 |
| SUSE Manager Server 4.0 | go1.15 | 1.15.7-1.17.1 |
| openSUSE Leap 15.1 | go1.14 | 1.14.14-lp151.28.1 |
| openSUSE Leap 15.2 | go1.14 | 1.14.14-lp152.2.18.1 |
| openSUSE Leap 15.2 | go1.15 | 1.15.7-lp152.8.1 |
| openSUSE Tumbleweed | go1.14 | 1.14.15-1.6 |
| openSUSE Tumbleweed | go1.15 | 1.15.15-1.2 |