OS Command Injection in Go programming language - CVE-2023-24531

Vulnerability identifier: #VU101963

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-24531

CWE-ID: CWE-78

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when handling output of environment variables. A local user can execute arbitrary commands on the system by setting specially crafted values to environment variables and making "go env" print them out.

Go programming language
Ubuntu
golang-1.18 (Ubuntu package)
golang-1.18-go (Ubuntu package)
golang-1.18-src (Ubuntu package)
golang-1.17 (Ubuntu package)
golang-1.17-go (Ubuntu package)
golang-1.17-src (Ubuntu package)

Install updates from vendor's website.

Go programming language - update to 1.21.0
golang-1.18 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.18.1-1ubuntu1.2, 1.18.1-1ubuntu1~20.04.3
golang-1.18-go (Ubuntu package) - addressed in versions Ubuntu Pro, 1.18.1-1ubuntu1.2, 1.18.1-1ubuntu1~20.04.3
golang-1.18-src (Ubuntu package) - addressed in versions Ubuntu Pro, 1.18.1-1ubuntu1.2, 1.18.1-1ubuntu1~20.04.3
golang-1.17 (Ubuntu package) - update to 1.17.13-3ubuntu1.2
golang-1.17-go (Ubuntu package) - update to 1.17.13-3ubuntu1.2
golang-1.17-src (Ubuntu package) - update to 1.17.13-3ubuntu1.2

• https://go.dev/cl/488375
• https://go.dev/cl/493535
• https://go.dev/issue/58508
• https://groups.google.com/g/golang-dev/c/ixHOFpSbajE/m/8EjlbKVWAwAJ
• https://pkg.go.dev/vuln/GO-2024-2962

• OS command injection in Go Programming language
• Ubuntu update for golang-1.18
• Ubuntu update for golang-1.17