blob: 0ca17393c1ce30fd33cc3add67d00414a7a2779b [file] [log] [blame]
id: GO-2022-0532
modules:
- module: std
versions:
- fixed: 1.17.11
- introduced: 1.18.0-0
fixed: 1.18.3
vulnerable_at: 1.18.2
packages:
- package: os/exec
goos:
- windows
symbols:
- Cmd.Start
summary: Empty Cmd.Path can trigger unintended binary in os/exec on Windows
description: |-
On Windows, executing Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when
Cmd.Path is unset will unintentionally trigger execution of any binaries in the
working directory named either "..com" or "..exe".
published: 2022-07-26T21:41:20Z
credits:
- Chris Darroch (chrisd8088@github.com)
- brian m. carlson (bk2204@github.com)
- Mikhail Shcherbakov (https://twitter.com/yu5k3)
references:
- fix: https://go.dev/cl/403759
- fix: https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345e
- report: https://go.dev/issue/52574
- web: https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ
cve_metadata:
id: CVE-2022-30580
cwe: 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
description: |-
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows
execution of any binaries in the working directory named either "..com" or
"..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when
Cmd.Path is unset.
review_status: REVIEWED