CVE-2012-2666: Critical severity Golang Go vulnerability
Published Jul 9, 2021
·Updated
golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntabtest.go creates a temporary file with predicable name and executes it as shell script.
Affected Software
1 affected component
Golang Go=1.0.2
Remediation
Patch Available
Event History
Jul 9, 2021
CVE Published
via MITRE·10:50 AM
Data Sourced
via MITRE·10:50 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2012-2666?
CVE-2012-2666 is considered a moderate severity vulnerability due to the predictable naming of temporary files.
2
How do I fix CVE-2012-2666?
To fix CVE-2012-2666, upgrade to Go programming language version 1.0.3 or later.
3
What type of vulnerability is CVE-2012-2666?
CVE-2012-2666 is a vulnerability related to insecure handling of temporary files in the Go programming language.
4
Who is affected by CVE-2012-2666?
CVE-2012-2666 affects users of Go programming language version 1.0.2 running on shared machines.
5
What can attackers do with CVE-2012-2666?
Attackers can exploit CVE-2012-2666 to execute arbitrary shell commands by manipulating temporary files.