Critical Vulnerability in go-toolset and golang
Summary
ALSA-2023:3923: Critical: go-toolset and golang security update. Affects go-toolset versions < 1.19.10-1.el9_2. Fixed in 1.19.10-1.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Go Toolset (also known as golang) provides the Go programming language tools and libraries. The golang packages offer the Go programming language compiler. This vulnerability affects the go-toolset and golang packages in AlmaLinux 9.
Vulnerability Detail
The vulnerability consists of multiple security issues:
- CVE-2023-29402: The go command in golang may generate unexpected code at build time when using cgo.
- CVE-2023-29404: The go command in golang may execute arbitrary code at build time when using cgo.
- CVE-2023-29405: The cmd/cgo package in golang is susceptible to arbitrary code execution triggered by linker flags.
- CVE-2023-29403: The runtime package in golang exhibits unexpected behavior in setuid/setgid binaries.
These vulnerabilities can lead to code generation issues, arbitrary code execution, and unexpected behavior in certain binaries.
How To Fix
Minimum fixed version
1.19.10-1.el9_2
This is the first release that contains the fix.
sudo dnf update go-toolsetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is crucial to update the affected packages to the fixed versions.
Conclusion
It is crucial to update the go-toolset and golang packages to address these critical vulnerabilities. Failure to do so may result in unexpected code generation, arbitrary code execution, and unexpected behavior in setuid/setgid binaries. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for go-toolset →
FAQ
Go Toolset, also known as golang, provides tools and libraries for the Go programming language.
These vulnerabilities can result in unexpected code generation, arbitrary code execution, and unexpected behavior in setuid/setgid binaries.
To fix these vulnerabilities, update the go-toolset and golang packages to version 1.19.10-1.el9_2 or later.
No, there are no known workarounds for these vulnerabilities.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for go-toolset.
