CVE-2020-28366

Published: 18 November 2020

Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection.

Notes

Packages built using golang need to be rebuilt once the
vulnerability has been fixed. This CVE entry does not
list packages that need rebuilding outside of the main
repository or the Ubuntu variants with PPA overlays.

Priority

Medium

CVSS 3 base score: 7.5

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28366
• https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM/m/fLguyiM2CAAJ
• NVD
• Launchpad
• Debian

Bugs

• https://github.com/golang/go/issues/42559