REDHAT-BUG-2434433: High severity go vulnerability
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2434433?
The severity of REDHAT-BUG-2434433 is classified as a vulnerability that allows an attacker to control file content partially.
How do I fix REDHAT-BUG-2434433?
To fix REDHAT-BUG-2434433, ensure to validate and sanitize file input to prevent unauthorized file access.
What software is affected by REDHAT-BUG-2434433?
REDHAT-BUG-2434433 affects the Go programming language environments using the cmd/go command.
What kind of attacks does REDHAT-BUG-2434433 enable?
REDHAT-BUG-2434433 enables potential attacks where an attacker can write to a file with partial control over its content.
Is it safe to use the #cgo pkg-config: directive in Go?
Using the #cgo pkg-config: directive in Go is not safe without proper input validation, as it can be exploited by an attacker.