| packages: |
| - module: std |
| package: cmd/go |
| symbols: |
| - validCompilerFlags |
| versions: |
| - fixed: 1.14.12 |
| - introduced: 1.15.0 |
| fixed: 1.15.5 |
| vulnerable_at: 1.15.4 |
| description: | |
| The go command may execute arbitrary code at build time when cgo is in use. |
| This may occur when running go get on a malicious package, or any other |
| command that builds untrusted code. |
| |
| This can be caused by malicious gcc flags specified via a cgo directive. |
| credit: Imre Rad |
| links: |
| pr: https://go.dev/cl/267277 |
| commit: https://go.googlesource.com/go/+/da7aa86917811a571e6634b45a457f918b8e6561 |
| context: |
| - https://go.dev/issue/42556 |
| - https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM |
| cve_metadata: |
| id: CVE-2020-28367 |
| cwe: 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' |
| description: | |
| Code injection in the go command with cgo before Go 1.14.12 and Go |
| 1.15.5 allows arbitrary code execution at build time via malicious |
| gcc flags specified via a #cgo directive. |
