A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
{
"binaries": [
{
"binary_name": "golang-1.8",
"binary_version": "1.8.3-2ubuntu1.18.04.1"
},
{
"binary_name": "golang-1.8-go",
"binary_version": "1.8.3-2ubuntu1.18.04.1"
},
{
"binary_name": "golang-1.8-go-shared-dev",
"binary_version": "1.8.3-2ubuntu1.18.04.1"
},
{
"binary_name": "golang-1.8-src",
"binary_version": "1.8.3-2ubuntu1.18.04.1"
},
{
"binary_name": "libgolang-1.8-std1",
"binary_version": "1.8.3-2ubuntu1.18.04.1"
}
]
}