Code Injection in Go programming language - CVE-2020-28366

Vulnerability identifier: #VU48478

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-28366

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation at build time when cgo is in use. A remote attacker can trick the victim into building a specially crafted application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Go programming language
Arch Linux
Gentoo Linux
Amazon Linux AMI
Fedora
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
openshift-serverless-clients (Red Hat package)
go (Alpine package)
delve
go-toolset-1.14 (Red Hat package)
go-toolset-1.14-golang (Red Hat package)
golang
go-toolset
golang-bin
golang-race
golang-docs
golang-misc
golang-src
golang-tests
ObjectScale
Dell PowerProtect Cyber Recovery
Red Hat Developer Tools
QRadar Suite
IBM Robotic Process Automation
Netcool Operations Insight
Red Hat OpenShift Serverless

Install updates from vendor's website.

Go programming language - addressed in versions 1.14.12, 1.15.5
openshift-serverless-clients (Red Hat package) - update to 0.18.4-2.el8
ObjectScale - update to 1.3.0
go (Alpine package) - update to 1.15.5-r0
QRadar Suite - update to 1.10.17.0
IBM Robotic Process Automation - update to 21.0.3.1
delve - update to 1.5.0-2
Netcool Operations Insight - update to 1.6.6
Red Hat OpenShift Serverless - update to 1.12.0
go-toolset-1.14 (Red Hat package) - update to 1.14.12-1.el7_9
go-toolset-1.14-golang (Red Hat package) - update to 1.14.12-1.el7_9
golang - addressed in versions 1.14.13-1.fc32, 1.15.5-1.el6, 1.15.5-1.el7, 1.15.5-1.fc33
go-toolset - update to 1.15.14-1
golang - update to 1.15.14-1
golang-bin - update to 1.15.14-1
golang-race - update to 1.15.14-1
golang-docs - update to 1.15.14-1
golang-misc - update to 1.15.14-1
golang-src - update to 1.15.14-1
golang-tests - update to 1.15.14-1
Dell PowerProtect Cyber Recovery - update to 19.14.0.1

• https://github.com/golang/go/issues/42562
• https://github.com/golang/go/commit/32159824698a82a174b60a6845e8494ae3243102

• Multiple vulnerabilities in Go programming language
• Arch Linux update for go
• Code Injection in go (Alpine package)
• Red Hat Developer Tools update for go-toolset-1.14-golang
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Amazon Linux AMI update for golang
• Amazon Linux AMI update for golang
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Red Hat OpenShift Serverless Client security update
• Gentoo update for Go
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Multiple vulnerabilities in IBM QRadar Suite software
• Anolis OS update for go-toolset:an8 module
• Fedora 33 update for golang
• Fedora EPEL 7 update for golang
• Fedora EPEL 6 update for golang
• Fedora 32 update for golang
• Multiple vulnerabilities in Dell ObjectScale