CVE-2022-30580
Fixed in a distro release EPSS <1%CVSS 7.8
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
Products: Go standard library os/exec
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | stdlib | 1.17.11 |
| Go | stdlib | 1.18.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | golang | 1.18.9-1.amzn2.0.2 |
| Amazon Linux 2 | golang-bin | 1.18.9-1.amzn2.0.2 |
| Amazon Linux 2 | golang-docs | 1.18.9-1.amzn2.0.2 |
| Amazon Linux 2 | golang-misc | 1.18.9-1.amzn2.0.2 |
| Amazon Linux 2 | golang-race | 1.18.9-1.amzn2.0.2 |
| Amazon Linux 2 | golang-shared | 1.18.9-1.amzn2.0.2 |
| Amazon Linux 2 | golang-src | 1.18.9-1.amzn2.0.2 |
| Amazon Linux 2 | golang-tests | 1.18.9-1.amzn2.0.2 |
| Amazon Linux 2023 | golang | 1.19.8-1.amzn2023.0.1 |
| Amazon Linux 2023 | golang-bin | 1.19.8-1.amzn2023.0.1 |
| Amazon Linux 2023 | golang-docs | 1.19.8-1.amzn2023.0.1 |
| Amazon Linux 2023 | golang-misc | 1.19.8-1.amzn2023.0.1 |
| Amazon Linux 2023 | golang-race | 1.19.8-1.amzn2023.0.1 |
| Amazon Linux 2023 | golang-shared | 1.19.8-1.amzn2023.0.1 |
| Amazon Linux 2023 | golang-src | 1.19.8-1.amzn2023.0.1 |
| Amazon Linux 2023 | golang-tests | 1.19.8-1.amzn2023.0.1 |
| SUSE Enterprise Storage 7.1 | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | go1.17 | 1.17.11-150000.1.37.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | go1.18 | 1.18.3-150000.1.20.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.17 | 1.17.11-150000.1.37.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.18 | 1.18.3-150000.1.20.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| SUSE Linux Enterprise Real Time 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| openSUSE Leap 15.3 | go1.17 | 1.17.11-150000.1.37.1 |
| openSUSE Leap 15.3 | go1.18 | 1.18.3-150000.1.20.1 |
| openSUSE Leap 15.4 | go1.17 | 1.17.11-150000.1.37.1 |
| openSUSE Leap 15.4 | go1.18 | 1.18.3-150000.1.20.1 |
| openSUSE Leap 15.4 | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| openSUSE Leap 15.5 | go1.18-openssl | 1.18.10.1-150000.1.9.1 |
| openSUSE Tumbleweed | go1.17 | 1.17.11-1.1 |
| openSUSE Tumbleweed | go1.18 | 1.18.3-1.1 |