Your submission was sent successfully! Close

CVE-2021-3115

Published: 26 January 2021

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

Notes

AuthorNote
sbeattie
Windows only
Priority

Medium

CVSS 3 base score: 7.5

Status

Package Release Status
golang
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

groovy Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

golang-1.10
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(windows only)
focal Does not exist

groovy Does not exist

precise Does not exist

trusty Not vulnerable
(windows only)
upstream Needs triage

xenial Not vulnerable
(windows only)
golang-1.13
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(windows only)
focal Not vulnerable
(windows only)
groovy Not vulnerable
(windows only)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable
(windows only)
golang-1.14
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Not vulnerable
(windows only)
groovy Not vulnerable
(windows only)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

golang-1.15
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

groovy Not vulnerable
(windows only)
precise Does not exist

trusty Does not exist

upstream
Released (1.15.7-1)
xenial Does not exist

Patches:
upstream: https://github.com/golang/go/commit/e8e7facfaa47bf21007c0a1c679debba52ec3ea0
golang-1.6
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

groovy Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable
(windows only)
golang-1.8
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(windows only)
focal Does not exist

groovy Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

golang-1.9
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(windows only)
focal Does not exist

groovy Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist