REDHAT-BUG-2384329: High severity Google Go vulnerability
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2384329?
The severity of REDHAT-BUG-2384329 is classified as moderate due to potential command execution risks.
How do I fix REDHAT-BUG-2384329?
To fix REDHAT-BUG-2384329, ensure that you use trusted VCS repositories and review the VCS configuration for safety.
What causes REDHAT-BUG-2384329?
REDHAT-BUG-2384329 is caused by the presence of unsafe VCS metadata in repositories fetched from different version control systems.
Who is affected by REDHAT-BUG-2384329?
Users operating Go commands in untrusted or mixed-version control system environments may be affected by REDHAT-BUG-2384329.
What are the risks of REDHAT-BUG-2384329?
The risks of REDHAT-BUG-2384329 include executing unexpected and potentially harmful commands, which can compromise system integrity.