DEBIAN-CVE-2023-29404

Source
https://security-tracker.debian.org/tracker/CVE-2023-29404
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-29404.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2023-29404
Upstream
Published
2023-06-08T21:15:17Z
Modified
2025-09-18T05:20:03Z
Summary
[none]
Details

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.

References

Affected packages

Debian:11 / golang-1.15

Package

Name
golang-1.15
Purl
pkg:deb/debian/golang-1.15?arch=source

Affected ranges

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / golang-1.19

Package

Name
golang-1.19
Purl
pkg:deb/debian/golang-1.19?arch=source

Affected ranges

Ecosystem specific

{
    "urgency": "not yet assigned"
}