CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
87.9%
The Go project reports:
The go command may execute arbitrary code at build time when cgo is
in use on Windows. This may occur when running “go get”, or
any other command that builds code. Only users who build untrusted
code (and don’t execute it) are affected. In addition to Windows
users, this can also affect Unix users who have “.” listed
explicitly in their PATH and are running “go get” or build
commands outside of a module or with module mode disabled.
The P224() Curve implementation can in rare circumstances generate
incorrect outputs, including returning invalid points from
ScalarMult. The crypto/x509 and golang.org/x/crypto/ocsp (but not
crypto/tls) packages support P-224 ECDSA keys, but they are not
supported by publicly trusted certificate authorities. No other
standard library or golang.org/x/crypto package supports or uses the
P-224 curve.
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
87.9%