CVE-2019-11888: Critical severity golang vulnerability
Published May 13, 2019
·Updated
Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, which allows attackers to obtain sensitive information or gain privileges.
Affected Software
2 affected components
Golang Go<=1.12.5
Microsoft Windows
Remediation
Patch Available
Event History
May 13, 2019
CVE Published
via MITRE·04:30 AM
Data Sourced
via MITRE·04:30 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-11888?
CVE-2019-11888 is considered to have high severity due to its potential for sensitive information disclosure and privilege escalation.
2
How do I fix CVE-2019-11888?
To fix CVE-2019-11888, users should upgrade to Go versions later than 1.12.5 that contain the necessary patches.
3
What versions of Go are affected by CVE-2019-11888?
CVE-2019-11888 affects Go versions 1.12.5 and earlier.
4
What type of vulnerability is CVE-2019-11888?
CVE-2019-11888 is a security vulnerability related to process creation mishandling and privilege escalation.
5
Can CVE-2019-11888 be exploited remotely?
CVE-2019-11888 requires local access to exploit, thus it is not considered a remote vulnerability.