BIT-golang-2022-30580
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/golang/BIT-golang-2022-30580.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-golang-2022-30580
- Aliases
- Published
- 2024-03-06T11:00:32.217Z
- Modified
- 2024-03-06T11:25:28.861Z
- Summary
- [none]
- Details
-
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
- Database specific
{ "cpes": [ "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*" ], "severity": "High" }- References
Affected packages
Bitnami / golang
Package
- Name
- golang
- Purl
- pkg:bitnami/golang
Severity
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator