Code Injection in Go programming language - CVE-2023-39320

Vulnerability identifier: #VU80571

CSH Severity: Medium

CVSS v4 BT: 4.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-39320

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation within the go.mod toolchain directive. A remote attacker can execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.

Go programming language
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Fedora
Development Tools Module
openSUSE Leap
AdGuard Home
Consul
Operations Dashboard
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Cloud Pak for Data Scheduling
IBM Watson Discovery for IBM Cloud Pak for Data
Splunk Enterprise
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
ObjectScale
Storage Protect Plus Container Agent
Storage Protect Plus Server
golang
dev-lang/go
go1.21-doc
go1.21-race
go1.21
go1.21-openssl-doc
go1.21-openssl
go1.21-openssl-race

Install updates from vendor's website.

Go programming language - update to 1.21.1
AdGuard Home - addressed in versions 0.107.37, 0.108.0-b.45
Consul - addressed in versions 1.14.10, 1.15.6, 1.16.2
Splunk Enterprise - addressed in versions 9.1.6, 9.2.3, 9.3.1
Operations Dashboard - update to 2022.2.1-16-lts
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-14
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2022.2.1-14, 2023.2.1-3
ObjectScale - update to 1.4.0
golang - addressed in versions 1.19.13-1.fc37, 1.20.8-1.fc38, 1.20.10-3.el7, 1.21.1-1.fc39
dev-lang/go - update to 1.20.10
go1.21-doc - update to 1.21.1-150000.1.6.1
go1.21-race - update to 1.21.1-150000.1.6.1
go1.21 - update to 1.21.1-150000.1.6.1
go1.21-openssl-doc - update to 1.21.4.1-150000.1.5.1
go1.21-openssl - update to 1.21.4.1-150000.1.5.1
go1.21-openssl-race - update to 1.21.4.1-150000.1.5.1
IBM Cloud Pak for Data Scheduling - update to 4.8
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.5
Storage Protect Plus Container Agent - update to 10.1.12.7
Storage Protect Plus Server - update to 10.1.16.2

• https://groups.google.com/g/golang-announce/c/Fm51GRLNRvM/m/F5bwBlXMAQAJ?pli=1
• https://go.dev/issue/62198

• Multiple vulnerabilities in Go programming language
• Multiple vulnerabilities in AdGuard Home
• Fedora 38 update for golang
• Fedora 39 update for golang
• Fedora 37 update for golang
• Multiple vulnerabilities in HashiCorp Consul
• SUSE update for go1.21
• Multiple vulnerabilities in Platform Navigator and Automation Assets in IBM Cloud Pak for Integration
• SUSE update for go1.21-openssl
• IBM Operations Dashboard update for Go
• Fedora EPEL 7 update for golang
• Gentoo update for Go
• Multiple vulnerabilities in IBM Cloud Pak for Data Scheduling
• Multiple vulnerabilities in IBM Storage Protect Plus Container Agent
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in Storage Protect Plus Server
• Splunk Enterprise update for third-party components