CVE-2023-39323 — Code Injection in Toolchain CMD GO
Severity
8.1HIGHNVD
EPSS
0.1%
top 81.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 5
Latest updateNov 14
Description
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9
Affected Packages2 packages
Also affects: Fedora 37, 38, 39
Patches
🔴Vulnerability Details
6GHSA▶
aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account↗2024-07-02
GHSA▶
GHSA-679v-hh23-h5jh: Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed d↗2023-10-05