Описание
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
A flaw was found in golang. The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program that uses cgo. This can occur when running an untrusted module that contains directories with newline characters in their names. Modules that are retrieved using the go command, for example, via "go get", are not affected. Modules retrieved using GOPATH-mode, for example, GO111MODULE=off may be affected.
Отчет
This vulnerability is only applicable to customer use of the go compiler and not any pre-compiled golang binaries shipped by Red Hat.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ceph Storage 3 | golang | Affected | ||
| Red Hat Storage 3 | golang | Affected | ||
| Red Hat Storage 3 | go-toolset-7-golang | Affected | ||
| Red Hat Ceph Storage 5.3 | rhceph/keepalived-rhel8 | Fixed | RHSA-2024:4119 | 26.06.2024 |
| Red Hat Ceph Storage 5.3 | rhceph/rhceph-5-dashboard-rhel8 | Fixed | RHSA-2024:4119 | 26.06.2024 |
| Red Hat Ceph Storage 5.3 | rhceph/rhceph-5-rhel8 | Fixed | RHSA-2024:4119 | 26.06.2024 |
| Red Hat Ceph Storage 5.3 | rhceph/rhceph-haproxy-rhel8 | Fixed | RHSA-2024:4119 | 26.06.2024 |
| Red Hat Ceph Storage 5.3 | rhceph/snmp-notifier-rhel8 | Fixed | RHSA-2024:4119 | 26.06.2024 |
| Red Hat Developer Tools | go-toolset-1.19 | Fixed | RHSA-2023:3920 | 29.06.2023 |
| Red Hat Developer Tools | go-toolset-1.19-golang | Fixed | RHSA-2023:3920 | 29.06.2023 |
Показывать по
Дополнительная информация
Статус:
EPSS
7 High
CVSS3
Связанные уязвимости
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
The go command may generate unexpected code at build time when using c ...
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
EPSS
7 High
CVSS3