CVE-2020-28367 Arbitrary code execution via the go command with cgo in cmd/go

2020-11-1800:00:00

www.cve.org

arbitrary code execution

go command

cgo

code injection

malicious gcc flags

AI Score

8.1

Confidence

High

EPSS

0.019

Percentile

88.7%

JSON

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

CNA Affected

[
  {
    "vendor": "Go toolchain",
    "product": "cmd/go",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "cmd/go",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.14.12",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.15.0-0",
        "lessThan": "1.15.5",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "validCompilerFlags"
      }
    ],
    "defaultStatus": "unaffected"
  }
]