CVE-2023-39323
Fixed in a distro release EPSS 2%CVSS 8.1
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
Products: Go toolchain cmd/go
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | toolchain | 1.20.9 |
| Go | toolchain | 1.21.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | golang | 1.20.10-1.amzn2.0.1 |
| Amazon Linux 2 | golang-bin | 1.20.10-1.amzn2.0.1 |
| Amazon Linux 2 | golang-docs | 1.20.10-1.amzn2.0.1 |
| Amazon Linux 2 | golang-misc | 1.20.10-1.amzn2.0.1 |
| Amazon Linux 2 | golang-shared | 1.20.10-1.amzn2.0.1 |
| Amazon Linux 2 | golang-src | 1.20.10-1.amzn2.0.1 |
| Amazon Linux 2 | golang-tests | 1.20.10-1.amzn2.0.1 |
| Amazon Linux 2023 | ecs-service-connect-agent | v1.27.2.0-1.amzn2023 |
| Amazon Linux 2023 | golang | 1.20.10-1.amzn2023.0.1 |
| Amazon Linux 2023 | golang-bin | 1.20.10-1.amzn2023.0.1 |
| Amazon Linux 2023 | golang-docs | 1.20.10-1.amzn2023.0.1 |
| Amazon Linux 2023 | golang-misc | 1.20.10-1.amzn2023.0.1 |
| Amazon Linux 2023 | golang-shared | 1.20.10-1.amzn2023.0.1 |
| Amazon Linux 2023 | golang-src | 1.20.10-1.amzn2023.0.1 |
| Amazon Linux 2023 | golang-tests | 1.20.10-1.amzn2023.0.1 |
| Chainguard | configmap-reload-fips | 0.12.0-r2 |
| Chainguard | katib-earlystopping | 0.19.0-r31 |
| Chainguard | katib-suggestion-goptuna-compat | 0.19.0-r40 |
| Chainguard | katib-suggestion-hyperband | 0.19.0-r31 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r40 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-darts | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Chainguard | katib-tfevent-metricscollector | 0.19.0-r31 |
| Chainguard | kind | 0.21.0-r0 |
| Chainguard | metrics-server | 0.6.4-r2 |
| Chainguard | smarter-device-manager-fips | 1.20.11-r2 |
| Debian 12 | golang-1.19 | no fix |
| Red Hat Enterprise Linux 8 | delve | 0:1.20.2-1.module+el8.9.0+18926+5193682d |
| Red Hat Enterprise Linux 8 | delve-debuginfo | 0:1.20.2-1.module+el8.9.0+18926+5193682d |
| Red Hat Enterprise Linux 8 | delve-debugsource | 0:1.20.2-1.module+el8.9.0+18926+5193682d |
| Red Hat Enterprise Linux 8 | go-toolset | 0:1.20.10-1.module+el8.9.0+20382+04f7fe80 |
| Red Hat Enterprise Linux 8 | golang | 0:1.20.10-1.module+el8.9.0+20382+04f7fe80 |
| Red Hat Enterprise Linux 8 | golang-bin | 0:1.20.10-1.module+el8.9.0+20382+04f7fe80 |
| Red Hat Enterprise Linux 8 | golang-docs | 0:1.20.10-1.module+el8.9.0+20382+04f7fe80 |
| Red Hat Enterprise Linux 8 | golang-misc | 0:1.20.10-1.module+el8.9.0+20382+04f7fe80 |
| Red Hat Enterprise Linux 8 | golang-src | 0:1.20.10-1.module+el8.9.0+20382+04f7fe80 |
| Red Hat Enterprise Linux 8 | golang-tests | 0:1.20.10-1.module+el8.9.0+20382+04f7fe80 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.20 | 1.20.9-150000.1.26.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.20-openssl | 1.20.11.1-150000.1.14.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.21 | 1.21.2-150000.1.9.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.21-openssl | 1.21.4.1-150000.1.5.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | go1.20 | 1.20.9-150000.1.26.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | go1.20-openssl | 1.20.11.1-150000.1.14.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | go1.21 | 1.21.2-150000.1.9.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | go1.21-openssl | 1.21.4.1-150000.1.5.1 |
| SUSE Package Hub 12 | go | 1.21-41.1 |
| SUSE Package Hub 12 | go1.21 | 1.21.3-2.1 |
| Ubuntu 20.04 LTS | golang-1.18 | 1.18.1-1ubuntu1~20.04.3 |
| Ubuntu 20.04 LTS | golang-1.20 | 1.20.3-1ubuntu0.1~20.04.1 |
| Ubuntu 20.04 LTS | golang-1.21 | 1.21.1-1~ubuntu20.04.2 |
| Ubuntu 22.04 LTS | golang-1.17 | 1.17.13-3ubuntu1.3 |
| Ubuntu 22.04 LTS | golang-1.18 | 1.18.1-1ubuntu1.2 |
| Ubuntu 22.04 LTS | golang-1.20 | 1.20.3-1ubuntu0.1~22.04.1 |
| Ubuntu 22.04 LTS | golang-1.21 | 1.21.1-1~ubuntu22.04.2 |
| Ubuntu Pro 16.04 LTS | golang-1.18 | 1.18.1-1ubuntu1~16.04.6+esm1 |
| Ubuntu Pro 18.04 LTS | golang-1.18 | 1.18.1-1ubuntu1~18.04.4+esm1 |
| Wolfi | katib-earlystopping | 0.19.0-r31 |
| Wolfi | katib-suggestion-goptuna-compat | 0.19.0-r40 |
| Wolfi | katib-suggestion-hyperband | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r40 |
| Wolfi | katib-suggestion-nas-darts | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Wolfi | katib-tfevent-metricscollector | 0.19.0-r31 |
| Wolfi | kind | 0.21.0-r0 |
| Wolfi | metrics-server | 0.6.4-r2 |
| openSUSE Leap 15.4 | go1.20 | 1.20.9-150000.1.26.1 |
| openSUSE Leap 15.4 | go1.20-openssl | 1.20.11.1-150000.1.14.1 |
| openSUSE Leap 15.4 | go1.21 | 1.21.2-150000.1.9.1 |
| openSUSE Leap 15.4 | go1.21-openssl | 1.21.4.1-150000.1.5.1 |
| openSUSE Leap 15.5 | go1.20 | 1.20.9-150000.1.26.1 |
| openSUSE Leap 15.5 | go1.20-openssl | 1.20.11.1-150000.1.14.1 |
| openSUSE Leap 15.5 | go1.21 | 1.21.2-150000.1.9.1 |
| openSUSE Leap 15.5 | go1.21-openssl | 1.21.4.1-150000.1.5.1 |
| openSUSE Tumbleweed | go1.20 | 1.20.9-1.1 |
| openSUSE Tumbleweed | go1.21 | 1.21.2-1.1 |