CVE-2021-3115: Command Injection
A flaw was found in golang: cmd/go, in which Go can execute arbitrary commands at build time when cgo is in use on Windows OS. On Linux/Unix, only users who have "." listed explicitly in their PATH variable are affected. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example cgo can execute a gcc program from an untrusted download).
— Microsoft
Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).
The go command may execute arbitrary code at build time when users have “.” listed explicitly in their PATH and are running “go get” or build commands outside of a module or with module mode disabled.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openshift-serverless-clientsto a version that resolves this vulnerability.Fixed in 0:0.20.0-6.el8 - Upgrade
Upgrade
redhat/openshift-serverless-clientsto a version that resolves this vulnerability.Fixed in 0:0.20.0-7.el8 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.15.7 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.14.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.16.2-1 - Upgrade
Upgrade
golang: cmd/goto a version that resolves this vulnerability.Fixed in 1.14.14 - Upgrade
Upgrade
golang: cmd/goto a version that resolves this vulnerability.Fixed in 1.15.7 - Configuration
Mitigate by ensuring the current user's PATH environment variable does not explicitly list '.' (dot); avoid running go get/build with '.' in PATH outside a module or with module mode disabled.
Go toolchain (go get / build) on Linux/Unix PATH = Remove '.' entry - Compensating control
For Linux/Unix environments, ensure PATH does not include '.' so the go command cannot execute arbitrary build-time code from the current directory when running go get/build outside of a module or with module mode disabled.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-3115?
CVE-2021-3115 is a vulnerability in Go programming language on Windows OS that allows for command injection and remote code execution.
What is the severity level of CVE-2021-3115?
The severity level of CVE-2021-3115 is high, with a CVSS score of 7.5.
Which versions of Go are affected by CVE-2021-3115?
Go versions before 1.14.14 and 1.15.x before 1.15.7 on Windows OS are affected by CVE-2021-3115.
How can I fix CVE-2021-3115?
To fix CVE-2021-3115, update your Go installations to version 1.14.14 or 1.15.7.
Is Microsoft Windows vulnerable to CVE-2021-3115?
No, Microsoft Windows is not vulnerable to CVE-2021-3115.