OS Command Injection in Go programming language - CVE-2021-3115

Vulnerability identifier: #VU50046

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3115

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when using the "go get" command to fetch modules that make use of cgo. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Go programming language
Arch Linux
Gentoo Linux
Fedora
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
openshift-serverless-clients (Red Hat package)
go (Alpine package)
golang
Red Hat OpenShift Serverless
IBM Cloud Pak for Multicloud Management

Install updates from vendor's website.

Go programming language - addressed in versions 1.14.14, 1.15.7
openshift-serverless-clients (Red Hat package) - addressed in versions 0.20.0-6.el8, 0.20.0-7.el8
Red Hat OpenShift Serverless - addressed in versions 1.10.2, 1.14.0, 1.14.1
go (Alpine package) - update to 1.15.7-r0
golang - addressed in versions 1.15.7-1.fc33, 1.15.14-1.el7
IBM Cloud Pak for Multicloud Management - update to 2.3.1

• https://blog.golang.org/path-security
• https://groups.google.com/g/golang-announce/c/mperVMGa98w

• Multiple vulnerabilities in Go
• Arch Linux update for go
• OS Command Injection in go (Alpine package)
• Multiple vulnerabilities in Red Hat Openshift Serverless Client
• Red Hat OpenShift Serverless update for golang
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in OpenShift Serverless
• Multiple vulnerabilities in OpenShift Serverless Client
• Gentoo update for Go
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Fedora 33 update for golang
• Fedora EPEL 7 update for golang