| { |
| "schema_version": "1.3.1", |
| "id": "GO-2021-0068", |
| "modified": "0001-01-01T00:00:00Z", |
| "published": "2021-04-14T20:04:52Z", |
| "aliases": [ |
| "CVE-2021-3115" |
| ], |
| "summary": "Arbitrary code injection via the go command with cgo on Windows in cmd/go", |
| "details": "The go command may execute arbitrary code at build time when using cgo on Windows. This can be triggered by running go get on a malicious module, or any other time the code is built.", |
| "affected": [ |
| { |
| "package": { |
| "name": "toolchain", |
| "ecosystem": "Go" |
| }, |
| "ranges": [ |
| { |
| "type": "SEMVER", |
| "events": [ |
| { |
| "introduced": "0" |
| }, |
| { |
| "fixed": "1.14.14" |
| }, |
| { |
| "introduced": "1.15.0-0" |
| }, |
| { |
| "fixed": "1.15.7" |
| } |
| ] |
| } |
| ], |
| "ecosystem_specific": { |
| "imports": [ |
| { |
| "path": "cmd/go", |
| "goos": [ |
| "windows" |
| ] |
| } |
| ] |
| } |
| } |
| ], |
| "references": [ |
| { |
| "type": "FIX", |
| "url": "https://go.dev/cl/284783" |
| }, |
| { |
| "type": "FIX", |
| "url": "https://go.googlesource.com/go/+/953d1feca9b21af075ad5fc8a3dad096d3ccc3a0" |
| }, |
| { |
| "type": "REPORT", |
| "url": "https://go.dev/issue/43783" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://groups.google.com/g/golang-announce/c/mperVMGa98w/m/yo5W5wnvAAAJ" |
| }, |
| { |
| "type": "FIX", |
| "url": "https://go.dev/cl/284780" |
| }, |
| { |
| "type": "FIX", |
| "url": "https://go.googlesource.com/go/+/46e2e2e9d99925bbf724b12693c6d3e27a95d6a0" |
| } |
| ], |
| "credits": [ |
| { |
| "name": "RyotaK" |
| } |
| ], |
| "database_specific": { |
| "url": "https://pkg.go.dev/vuln/GO-2021-0068", |
| "review_status": "REVIEWED" |
| } |
| } |
