CVE-2023-29402
Fixed in a distro release EPSS 2%CVSS 9.8
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
Products: Go toolchain cmd/go
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | toolchain | 1.19.10 |
| Go | toolchain | 1.20.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | delve | 1.9.1-1.module_el8.8.0+3471+a62632a0 |
| AlmaLinux 8 | go-toolset | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 8 | golang | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 8 | golang-bin | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 8 | golang-docs | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 8 | golang-misc | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 8 | golang-race | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 8 | golang-src | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 8 | golang-tests | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 9 | go-toolset | 1.19.10-1.el9_2 |
| AlmaLinux 9 | golang | 1.19.10-1.el9_2 |
| AlmaLinux 9 | golang-bin | 1.19.10-1.el9_2 |
| AlmaLinux 9 | golang-docs | 1.19.10-1.el9_2 |
| AlmaLinux 9 | golang-misc | 1.19.10-1.el9_2 |
| AlmaLinux 9 | golang-race | 1.19.10-1.el9_2 |
| AlmaLinux 9 | golang-src | 1.19.10-1.el9_2 |
| AlmaLinux 9 | golang-tests | 1.19.10-1.el9_2 |
| Amazon Linux 2 | golang | 1.18.9-1.amzn2.0.6 |
| Amazon Linux 2 | golang-bin | 1.18.9-1.amzn2.0.6 |
| Amazon Linux 2 | golang-docs | 1.18.9-1.amzn2.0.6 |
| Amazon Linux 2 | golang-misc | 1.18.9-1.amzn2.0.6 |
| Amazon Linux 2 | golang-race | 1.18.9-1.amzn2.0.6 |
| Amazon Linux 2 | golang-shared | 1.18.9-1.amzn2.0.6 |
| Amazon Linux 2 | golang-src | 1.18.9-1.amzn2.0.6 |
| Amazon Linux 2 | golang-tests | 1.18.9-1.amzn2.0.6 |
| Amazon Linux 2023 | golang | 1.20.5-1.amzn2023.0.2 |
| Amazon Linux 2023 | golang-bin | 1.20.5-1.amzn2023.0.2 |
| Amazon Linux 2023 | golang-docs | 1.20.5-1.amzn2023.0.2 |
| Amazon Linux 2023 | golang-misc | 1.20.5-1.amzn2023.0.2 |
| Amazon Linux 2023 | golang-shared | 1.20.5-1.amzn2023.0.2 |
| Amazon Linux 2023 | golang-src | 1.20.5-1.amzn2023.0.2 |
| Amazon Linux 2023 | golang-tests | 1.20.5-1.amzn2023.0.2 |
| Chainguard | katib-earlystopping | 0.19.0-r31 |
| Chainguard | katib-suggestion-goptuna-compat | no fix |
| Chainguard | katib-suggestion-hyperband | 0.19.0-r31 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r40 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-darts | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Chainguard | katib-tfevent-metricscollector | 0.19.0-r31 |
| Chainguard | kind | 0.21.0-r0 |
| Chainguard | policy-controller | 0.7.0-r4 |
| Debian 12 | golang-1.19 | no fix |
| Red Hat devtools 2023 | go-toolset-1.19 | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-build | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-bin | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-docs | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-misc | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-race | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-src | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-tests | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-runtime | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-scldevel | 0:1.19.10-1.el7_9 |
| Red Hat Enterprise Linux 8 | delve | 0:1.9.1-1.module+el8.8.0+16778+5fbb74f5 |
| Red Hat Enterprise Linux 8 | delve-debuginfo | 0:1.9.1-1.module+el8.8.0+16778+5fbb74f5 |
| Red Hat Enterprise Linux 8 | delve-debugsource | 0:1.9.1-1.module+el8.8.0+16778+5fbb74f5 |
| Red Hat Enterprise Linux 8 | go-toolset | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 8 | golang | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 8 | golang-bin | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 8 | golang-docs | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 8 | golang-misc | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 8 | golang-race | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 8 | golang-src | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 8 | golang-tests | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 9 | go-toolset | 0:1.19.10-1.el9_2 |
| Red Hat Enterprise Linux 9 | golang | 0:1.19.10-1.el9_2 |
| Red Hat Enterprise Linux 9 | golang-bin | 0:1.19.10-1.el9_2 |
| Red Hat Enterprise Linux 9 | golang-docs | 0:1.19.10-1.el9_2 |
| Red Hat Enterprise Linux 9 | golang-misc | 0:1.19.10-1.el9_2 |
| Red Hat Enterprise Linux 9 | golang-race | 0:1.19.10-1.el9_2 |
| Red Hat Enterprise Linux 9 | golang-src | 0:1.19.10-1.el9_2 |
| Red Hat Enterprise Linux 9 | golang-tests | 0:1.19.10-1.el9_2 |
| Rocky Linux 9 | go-toolset | 0:1.19.10-1.el9_2 |
| Rocky Linux 9 | golang | 0:1.19.10-1.el9_2 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.19 | 1.19.10-150000.1.34.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.20 | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | go1.19 | 1.19.10-150000.1.34.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | go1.20 | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise Real Time 15 SP3 | go1.19 | 1.19.10-150000.1.34.1 |
| SUSE Linux Enterprise Real Time 15 SP3 | go1.20 | 1.20.5-150000.1.14.1 |
| Ubuntu 14.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.6 | no fix |
| Ubuntu 18.04 LTS | golang-1.10 | no fix |
| Ubuntu 18.04 LTS | golang-1.8 | no fix |
| Ubuntu 18.04 LTS | golang-1.9 | no fix |
| Ubuntu 20.04 LTS | golang-1.13 | no fix |
| Ubuntu 20.04 LTS | golang-1.14 | no fix |
| Ubuntu 20.04 LTS | golang-1.18 | 1.18.1-1ubuntu1~20.04.3 |
| Ubuntu 20.04 LTS | golang-1.20 | no fix |
| Ubuntu 22.04 LTS | golang-1.17 | 1.17.13-3ubuntu1.2 |
| Ubuntu 22.04 LTS | golang-1.18 | 1.18.1-1ubuntu1.2 |
| Ubuntu 22.04 LTS | golang-1.20 | no fix |
| Ubuntu Pro 16.04 LTS | golang-1.13 | no fix |
| Ubuntu Pro 16.04 LTS | golang-1.18 | 1.18.1-1ubuntu1~16.04.6+esm1 |
| Ubuntu Pro 18.04 LTS | golang-1.13 | no fix |
| Ubuntu Pro 18.04 LTS | golang-1.16 | no fix |
| Ubuntu Pro 18.04 LTS | golang-1.18 | 1.18.1-1ubuntu1~18.04.4+esm1 |
| Ubuntu Pro 20.04 LTS | golang-1.16 | no fix |
| Ubuntu Pro 22.04 LTS | golang-1.13 | no fix |
| Wolfi | katib-earlystopping | 0.19.0-r31 |
| Wolfi | katib-suggestion-goptuna-compat | no fix |
| Wolfi | katib-suggestion-hyperband | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r40 |
| Wolfi | katib-suggestion-nas-darts | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Wolfi | katib-tfevent-metricscollector | 0.19.0-r31 |
| Wolfi | kind | 0.21.0-r0 |
| Wolfi | policy-controller | 0.7.0-r4 |
| openSUSE Leap 15.4 | go1.19 | 1.19.10-150000.1.34.1 |
| openSUSE Leap 15.4 | go1.20 | 1.20.5-150000.1.14.1 |
| openSUSE Leap 15.5 | go1.19 | 1.19.10-150000.1.34.1 |
| openSUSE Leap 15.5 | go1.20 | 1.20.5-150000.1.14.1 |
| openSUSE Tumbleweed | go1.19 | 1.19.10-1.1 |
| openSUSE Tumbleweed | go1.20 | 1.20.5-1.1 |