Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-delvealma-upgrade-go-toolsetalma-upgrade-golangalma-upgrade-golang-binalma-upgrade-golang-docsalma-upgrade-golang-miscalma-upgrade-golang-racealma-upgrade-golang-srcalma-upgrade-golang-tests | May 4, 2022 | Nov 18, 2020 | |
| Alpine Linux | alpine-linux-upgrade-go | Aug 22, 2024 | Nov 18, 2020 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-golangamazon-linux-ami-2-upgrade-golang-binamazon-linux-ami-2-upgrade-golang-docsamazon-linux-ami-2-upgrade-golang-miscamazon-linux-ami-2-upgrade-golang-raceamazon-linux-ami-2-upgrade-golang-srcamazon-linux-ami-2-upgrade-golang-tests | Jan 8, 2021 | Nov 18, 2020 | |
| Amazon_linux | — | amazon-linux-upgrade-golang | Dec 19, 2020 | Nov 9, 2020 |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Nov 18, 2020 | |
| Centos_linux | — | centos-upgrade-delvecentos-upgrade-delve-debuginfocentos-upgrade-delve-debugsourcecentos-upgrade-go-toolsetcentos-upgrade-golangcentos-upgrade-golang-bincentos-upgrade-golang-docscentos-upgrade-golang-misccentos-upgrade-golang-racecentos-upgrade-golang-srccentos-upgrade-golang-tests | Dec 21, 2020 | Nov 18, 2020 |
| Debian | debian-upgrade-golang-1-15 | Jul 30, 2024 | Nov 18, 2020 | |
| Freebsd | freebsd-upgrade-package-go | Nov 13, 2020 | Nov 12, 2020 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-lang-go | Aug 5, 2022 | Nov 18, 2020 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-golanghuawei-euleros-2_0_sp3-upgrade-golang-binhuawei-euleros-2_0_sp3-upgrade-golang-src | Oct 26, 2021 | Nov 18, 2020 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-golanghuawei-euleros-2_0_sp5-upgrade-golang-binhuawei-euleros-2_0_sp5-upgrade-golang-src | Mar 24, 2021 | Nov 18, 2020 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-golanghuawei-euleros-2_0_sp8-upgrade-golang-binhuawei-euleros-2_0_sp8-upgrade-golang-src | Feb 2, 2021 | Nov 18, 2020 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-golanghuawei-euleros-2_0_sp9-upgrade-golang-develhuawei-euleros-2_0_sp9-upgrade-golang-help | Jan 5, 2021 | Nov 18, 2020 | |
| Oracle_linux | — | oracle-linux-upgrade-delveoracle-linux-upgrade-golangoracle-linux-upgrade-golang-binoracle-linux-upgrade-golang-docsoracle-linux-upgrade-golang-miscoracle-linux-upgrade-golang-raceoracle-linux-upgrade-golang-srcoracle-linux-upgrade-golang-testsoracle-linux-upgrade-go-toolset | Dec 23, 2020 | Nov 12, 2020 |
| Redhat_linux | redhat-upgrade-delveredhat-upgrade-delve-debuginforedhat-upgrade-delve-debugsourceredhat-upgrade-go-toolsetredhat-upgrade-golangredhat-upgrade-golang-binredhat-upgrade-golang-docsredhat-upgrade-golang-miscredhat-upgrade-golang-raceredhat-upgrade-golang-srcredhat-upgrade-golang-tests | Dec 21, 2020 | Nov 18, 2020 | |
| Suse | — | suse-upgrade-go1-14suse-upgrade-go1-14-docsuse-upgrade-go1-14-racesuse-upgrade-go1-15suse-upgrade-go1-15-docsuse-upgrade-go1-15-race | Nov 27, 2020 | Nov 9, 2020 |
| Ubuntu | no-fix-ubuntu-package | Jun 26, 2025 | Nov 18, 2020 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Nov 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub