正文

Google Go 代码注入漏洞

admin
admin V管理员 /0 评论 /13 阅读
0302
此篇文章发布距今已超过1162天，您需要注意文章的内容或图片是否可用！

漏洞信息详情

Google Go 代码注入漏洞

  • CNNVD编号：CNNVD-202011-1429
    • <!--
  • 危害等级： 高危-->
  • 危害等级： 高危
  • CVE编号： CVE-2020-28366
  • 漏洞类型： 代码注入
  • 发布时间： 2020-11-16
  • 威胁类型： 远程
  • 更新时间： 2021-03-01
  • 厂        商：
  • 漏洞来源： Red Hat

漏洞简介

Google Go是美国谷歌（Google）公司的一款静态强类型、编译型、并发型，并具有垃圾回收功能的编程语言。

go 1.15.5,1之前版本存在安全漏洞，该漏洞源于当使用cgo时，go命令可能在构建时执行任意代码。当在恶意包上运行go get或构建不受信任代码的任何其他命令时，可能会出现这种情况。

漏洞公告

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://www.vuxml.org/freebsd/db4b2f27-252a-11eb-865c-00155d646400.html

参考网址

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/F3ZSHGNTJWCWYAKY5OLZS2XQQYHSXSUO/

来源:CONFIRM

链接:https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM

来源:MISC

链接:https://github.com/golang/go/issues/42559

来源:CONFIRM

链接:https://security.netapp.com/advisory/ntap-20201202-0004/

来源:MLIST

链接:https://lists.apache.org/thread.html/rd02e75766cd333a0df417588460f5e4477060633000bfe94955851fd@%3Cissues.trafficcontrol.apache.org%3E

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/2W4COUPL3YVTZ6RTEIT6LPBDJUFF3VSP/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.4130/

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/160961/Red-Hat-Security-Advisory-2021-0146-01.html

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/160955/Red-Hat-Security-Advisory-2021-0145-01.html

来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2020-28366

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-integration-is-affected-by-multiple-go-vulnerabilities/

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/160340/Red-Hat-Security-Advisory-2020-5333-01.html

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.4287/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.4442/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.4063/

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-certified-container-software-is-vulnerable-to-multiple-vulnerabilities-within-golang-go-cve-2020-28367-cve-2020-28366/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0692

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-ibm-cloud-pak-for-data-affected-by-vulnerability-in-go-3/

来源:vigilance.fr

链接:https://vigilance.fr/vulnerability/Go-code-execution-via-Code-Injection-33935

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-in-go-affect-ibm-cloud-pak-for-multicloud-management-hybrid-grc-2/

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-enterprise-certified-container-operator-and-integration-servers-are-vulnerable-to-code-injection-and-denial-of-service-attacks/

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/160526/Red-Hat-Security-Advisory-2020-5493-01.html

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0170/

受影响实体

    暂无


补丁

  • Google Go 代码注入漏洞的修复措施
    <!--
    2020-11-16
    -->