CVE-2023-29405
Fixed in a distro release EPSS 2%CVSS 9.8
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.
Products: Go toolchain cmd/go, Go toolchain cmd/cgo
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | toolchain | 1.19.10 |
| Go | toolchain | 1.20.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | delve | 1.9.1-1.module_el8.8.0+3471+a62632a0 |
| AlmaLinux 8 | go-toolset | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 8 | golang | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 8 | golang-bin | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 8 | golang-docs | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 8 | golang-misc | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 8 | golang-race | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 8 | golang-src | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 8 | golang-tests | 1.19.10-1.module_el8.8.0+3571+89db2ae0 |
| AlmaLinux 9 | go-toolset | 1.19.10-1.el9_2 |
| AlmaLinux 9 | golang | 1.19.10-1.el9_2 |
| AlmaLinux 9 | golang-bin | 1.19.10-1.el9_2 |
| AlmaLinux 9 | golang-docs | 1.19.10-1.el9_2 |
| AlmaLinux 9 | golang-misc | 1.19.10-1.el9_2 |
| AlmaLinux 9 | golang-race | 1.19.10-1.el9_2 |
| AlmaLinux 9 | golang-src | 1.19.10-1.el9_2 |
| AlmaLinux 9 | golang-tests | 1.19.10-1.el9_2 |
| Amazon Linux 2 | golang | 1.20.5-1.amzn2.0.2 |
| Amazon Linux 2 | golang-bin | 1.20.5-1.amzn2.0.2 |
| Amazon Linux 2 | golang-docs | 1.20.5-1.amzn2.0.2 |
| Amazon Linux 2 | golang-misc | 1.20.5-1.amzn2.0.2 |
| Amazon Linux 2 | golang-shared | 1.20.5-1.amzn2.0.2 |
| Amazon Linux 2 | golang-src | 1.20.5-1.amzn2.0.2 |
| Amazon Linux 2 | golang-tests | 1.20.5-1.amzn2.0.2 |
| Amazon Linux 2023 | golang | 1.20.5-1.amzn2023.0.2 |
| Amazon Linux 2023 | golang-bin | 1.20.5-1.amzn2023.0.2 |
| Amazon Linux 2023 | golang-docs | 1.20.5-1.amzn2023.0.2 |
| Amazon Linux 2023 | golang-misc | 1.20.5-1.amzn2023.0.2 |
| Amazon Linux 2023 | golang-shared | 1.20.5-1.amzn2023.0.2 |
| Amazon Linux 2023 | golang-src | 1.20.5-1.amzn2023.0.2 |
| Amazon Linux 2023 | golang-tests | 1.20.5-1.amzn2023.0.2 |
| Chainguard | katib-earlystopping | 0.19.0-r31 |
| Chainguard | katib-suggestion-goptuna-compat | no fix |
| Chainguard | katib-suggestion-hyperband | 0.19.0-r31 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r40 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-darts | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Chainguard | katib-tfevent-metricscollector | 0.19.0-r31 |
| Chainguard | kind | 0.21.0-r0 |
| Chainguard | policy-controller | 0.7.0-r4 |
| Debian 12 | golang-1.19 | no fix |
| Red Hat devtools 2023 | go-toolset-1.19 | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-build | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-bin | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-docs | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-misc | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-race | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-src | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-tests | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-runtime | 0:1.19.10-1.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-scldevel | 0:1.19.10-1.el7_9 |
| Red Hat Enterprise Linux 8 | delve | 0:1.9.1-1.module+el8.8.0+16778+5fbb74f5 |
| Red Hat Enterprise Linux 8 | delve-debuginfo | 0:1.9.1-1.module+el8.8.0+16778+5fbb74f5 |
| Red Hat Enterprise Linux 8 | delve-debugsource | 0:1.9.1-1.module+el8.8.0+16778+5fbb74f5 |
| Red Hat Enterprise Linux 8 | go-toolset | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 8 | golang | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 8 | golang-bin | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 8 | golang-docs | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 8 | golang-misc | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 8 | golang-race | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 8 | golang-src | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 8 | golang-tests | 0:1.19.10-1.module+el8.8.0+19203+782922b7 |
| Red Hat Enterprise Linux 9 | go-toolset | 0:1.19.10-1.el9_2 |
| Red Hat Enterprise Linux 9 | golang | 0:1.19.10-1.el9_2 |
| Red Hat Enterprise Linux 9 | golang-bin | 0:1.19.10-1.el9_2 |
| Red Hat Enterprise Linux 9 | golang-docs | 0:1.19.10-1.el9_2 |
| Red Hat Enterprise Linux 9 | golang-misc | 0:1.19.10-1.el9_2 |
| Red Hat Enterprise Linux 9 | golang-race | 0:1.19.10-1.el9_2 |
| Red Hat Enterprise Linux 9 | golang-src | 0:1.19.10-1.el9_2 |
| Red Hat Enterprise Linux 9 | golang-tests | 0:1.19.10-1.el9_2 |
| Rocky Linux 9 | go-toolset | 0:1.19.10-1.el9_2 |
| Rocky Linux 9 | golang | 0:1.19.10-1.el9_2 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.19 | 1.19.10-150000.1.34.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.20 | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | go1.19 | 1.19.10-150000.1.34.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | go1.20 | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise Real Time 15 SP3 | go1.19 | 1.19.10-150000.1.34.1 |
| SUSE Linux Enterprise Real Time 15 SP3 | go1.20 | 1.20.5-150000.1.14.1 |
| Ubuntu 14.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.6 | no fix |
| Ubuntu 18.04 LTS | golang-1.10 | no fix |
| Ubuntu 18.04 LTS | golang-1.8 | no fix |
| Ubuntu 18.04 LTS | golang-1.9 | no fix |
| Ubuntu 20.04 LTS | golang-1.13 | no fix |
| Ubuntu 20.04 LTS | golang-1.14 | no fix |
| Ubuntu 20.04 LTS | golang-1.18 | 1.18.1-1ubuntu1~20.04.3 |
| Ubuntu 20.04 LTS | golang-1.20 | no fix |
| Ubuntu 22.04 LTS | golang-1.17 | 1.17.13-3ubuntu1.2 |
| Ubuntu 22.04 LTS | golang-1.18 | 1.18.1-1ubuntu1.2 |
| Ubuntu 22.04 LTS | golang-1.20 | no fix |
| Ubuntu Pro 16.04 LTS | golang-1.13 | no fix |
| Ubuntu Pro 16.04 LTS | golang-1.18 | 1.18.1-1ubuntu1~16.04.6+esm1 |
| Ubuntu Pro 18.04 LTS | golang-1.13 | no fix |
| Ubuntu Pro 18.04 LTS | golang-1.16 | no fix |
| Ubuntu Pro 18.04 LTS | golang-1.18 | 1.18.1-1ubuntu1~18.04.4+esm1 |
| Ubuntu Pro 20.04 LTS | golang-1.16 | no fix |
| Ubuntu Pro 22.04 LTS | golang-1.13 | no fix |
| Wolfi | katib-earlystopping | 0.19.0-r31 |
| Wolfi | katib-suggestion-goptuna-compat | no fix |
| Wolfi | katib-suggestion-hyperband | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r40 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-darts | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Wolfi | katib-tfevent-metricscollector | 0.19.0-r31 |
| Wolfi | kind | 0.21.0-r0 |
| Wolfi | policy-controller | 0.7.0-r4 |
| openSUSE Leap 15.4 | go1.19 | 1.19.10-150000.1.34.1 |
| openSUSE Leap 15.4 | go1.20 | 1.20.5-150000.1.14.1 |
| openSUSE Leap 15.5 | go1.19 | 1.19.10-150000.1.34.1 |
| openSUSE Leap 15.5 | go1.20 | 1.20.5-150000.1.14.1 |
| openSUSE Tumbleweed | go1.19 | 1.19.10-1.1 |
| openSUSE Tumbleweed | go1.20 | 1.20.5-1.1 |