Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

Risk 89
Severity
9.8
Code Injection, Input Validation
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An input validation vulnerability was found in Go. From a generated go file (from the cgo tool), it is possible to modify symbols within that object file and specify code. This flaw allows an attacker to create a repository that includes malicious pre-built object files that could execute arbitrary code when downloaded and run via go get or go build while building a Go project. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

1 / 4

Remedy

If it's possible to confirm that the Go project being built does not rely on any cgo code in the included dependencies, the env variable CGO_ENABLED=0 can be specified when using either `go get` or `go build`. For example: CGO_ENABLED=0 go get github.com/someproject This will not stop the files being downloaded but will stop any automatic complication of the cgo code, including inlined in the go file and separate .c files. Of course, this will only be effective if cgo is not relied upon in a given dependency and may not be appropriate in all scenarios.
First published (updated )
CVE-2020-28366

GJSON <= 1.9.2 allows attackers to cause a redos via crafted JSON input.

Risk 45
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-ppj4-34rq-v8j9. This link is maintained to preserve external references.

Original Description GJSON <= 1.9.2 allows attackers to cause a redos via crafted JSON input.

1 / 4
Source: GitHub
First published (updated )
CVE-2021-42248

IBM Cloud Pak for Security information disclosure

Risk 39
Severity
6.5
Infoleak
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authenticated user to obtain sensitive version information that could aid in further attacks against the system. IBM X-Force ID: 233665.

1 / 2
First published (updated )
CVE-2022-36777

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203