Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2020-28367

Опубликовано: 12 нояб. 2020
Источник: redhat
CVSS3: 7.5
EPSS Низкий

Описание

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

An input validation vulnerability was found in Go. If cgo is specified in a Go file, it is possible to bypass the validation of arguments to the gcc compiler. This flaw allows an attacker to create a malicious repository that can execute arbitrary code when downloaded and run via go get or go build while building a Go project. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Отчет

While the OpenShift Container Platform (OCP), Red Hat OpenShift Jaeger (RHOSJ), OpenShift Service Mesh (OSSM), and OpenShift Virtualization all contain RPMs and containers that are compiled with a vulnerable version of Go, the vulnerability is specific to the building of the Go code itself. Using go get or go build and as such, the relevant components have been marked as not affected. Additionally, only the main RPMs and containers for OCP, RHOSJ, OSSM, and OpenShift Virtualization are represented due to the large volume of not affected components. Red Hat Ceph Storage 3 ships the vulnerable version of go, and an attacker building go code on RHCS 3 could potentially exploit this vulnerability.

Меры по смягчению последствий

If it's possible to confirm that the go project being built does not rely on any cgo code in the included dependencies, the env variable CGO_ENABLED=0 can be specified when using either go get or go build.
For example: CGO_ENABLED=0 go get github.com/someproject This will not stop the files being downloaded but will stop any automatic complication of the cgo code, including inlined in the go file and separate .c files. Of course, this will only be effective if cgo is not relied upon in a given dependency and may not be appropriate in all scenarios.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Distributed Tracing Jaeger 1distributed-tracing/jaeger-all-in-one-rhel7Not affected
Distributed Tracing Jaeger 1distributed-tracing/jaeger-all-in-one-rhel8Not affected
Distributed Tracing Jaeger 1jaeger-rhel7-operatorNot affected
Distributed Tracing Jaeger 1jaeger-rhel8-operatorNot affected
OpenShift Serverlessknative-servingAffected
OpenShift Service Mesh 1kialiNot affected
OpenShift Service Mesh 1servicemeshNot affected
OpenShift Service Mesh 1servicemesh-operatorNot affected
OpenShift Service Mesh 2.0kialiNot affected
OpenShift Service Mesh 2.0servicemeshNot affected

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-20
https://bugzilla.redhat.com/show_bug.cgi?id=1897646golang: improper validation of cgo flags can lead to code execution at build time

EPSS

Процентиль: 50%
0.00272
Низкий

7.5 High

CVSS3

Связанные уязвимости

CVSS3: 7.5
ubuntu
около 5 лет назад

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

CVSS3: 7.5
nvd
около 5 лет назад

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

CVSS3: 7.5
msrc
около 5 лет назад

Описание отсутствует

CVSS3: 7.5
debian
около 5 лет назад

Code injection in the go command with cgo before Go 1.14.12 and Go 1.1 ...

CVSS3: 7.5
github
больше 3 лет назад

Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection.

EPSS

Процентиль: 50%
0.00272
Низкий

7.5 High

CVSS3