Critical Vulnerability in go-toolset:rhel8
Summary
ALSA-2023:3922: Critical: go-toolset:rhel8 security update. Affects delve versions < 1.9.1-1.module_el8.8.0+3471+a62632a0. Fixed in 1.9.1-1.module_el8.8.0+3471+a62632a0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Go Toolset is a collection of tools and libraries for the Go programming language (golang). It provides developers with a comprehensive set of resources to build efficient and reliable applications. However, a critical vulnerability has been discovered in go-toolset:rhel8 that could potentially compromise the security and integrity of the software.
Vulnerability Detail
The vulnerability (CVE-2023-29402, CVE-2023-29403, CVE-2023-29404, CVE-2023-29405) arises from various issues within the go-toolset package. These include the generation of unexpected code at build time, arbitrary code execution during the build process, and unexpected behavior of setuid/setgid binaries. These vulnerabilities can be exploited by attackers to execute malicious code, potentially leading to unauthorized access, data breaches, or system compromise.
How To Fix
Minimum fixed version
1.9.1-1.module_el8.8.0+3471+a62632a0
This is the first release that contains the fix.
sudo dnf update delveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is crucial to apply the recommended fix by updating the go-toolset package to the latest version.
Conclusion
The go-toolset:rhel8 package is affected by critical vulnerabilities that can lead to unauthorized code execution and unexpected behavior. It is essential to update the package to the latest version to mitigate the risk of exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for delve →
FAQ
Go Toolset is a collection of tools and libraries for the Go programming language (golang). It provides developers with a comprehensive set of resources to build efficient and reliable applications.
These vulnerabilities can allow attackers to execute arbitrary code, potentially leading to unauthorized access, data breaches, or system compromise.
To fix this vulnerability, update the go-toolset package to version 1.19.10-1.module_el8.8.0+3571+89db2ae0 or later.
There are no known workarounds for these vulnerabilities. It is crucial to apply the recommended fix by updating the go-toolset package.
For more details about these vulnerabilities, including their impact and CVSS scores, refer to the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for delve.
