Skip to content

Commit 93c684c

Browse files
tatianabtatianab
committed
data/reports: add GO-2023-1840.yaml
Aliases: CVE-2023-29403 Updates #1840 Change-Id: I0c0829d98d1ec4ff5997245189958b4b7cc362d8 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/501837 Reviewed-by: Roland Shoemaker <[email protected]> Run-TryBot: Tatiana Bradley <[email protected]> TryBot-Result: Gopher Robot <[email protected]>
1 parent 03108e7 commit 93c684c

File tree

3 files changed

+170
-0
lines changed

3 files changed

+170
-0
lines changed

‎data/cve/v5/GO-2023-1840.json

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.0",
4+
"cveMetadata": {
5+
"cveId": "CVE-2023-29403"
6+
},
7+
"containers": {
8+
"cna": {
9+
"providerMetadata": {
10+
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
11+
},
12+
"descriptions": [
13+
{
14+
"lang": "en",
15+
"value": "On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers."
16+
}
17+
],
18+
"affected": [
19+
{
20+
"vendor": "Go toolchain",
21+
"product": "cmd/go",
22+
"collectionURL": "https://pkg.go.dev",
23+
"packageName": "cmd/go",
24+
"versions": [
25+
{
26+
"version": "0",
27+
"lessThan": "1.19.10",
28+
"status": "affected",
29+
"versionType": "semver"
30+
},
31+
{
32+
"version": "1.20.0-0",
33+
"lessThan": "1.20.5",
34+
"status": "affected",
35+
"versionType": "semver"
36+
}
37+
],
38+
"defaultStatus": "unaffected"
39+
}
40+
],
41+
"problemTypes": [
42+
{
43+
"descriptions": [
44+
{
45+
"lang": "en",
46+
"description": "CWE-642: External Control of Critical State Data"
47+
}
48+
]
49+
}
50+
],
51+
"references": [
52+
{
53+
"url": "https://go.dev/issue/60272"
54+
},
55+
{
56+
"url": "https://go.dev/cl/501223"
57+
},
58+
{
59+
"url": "https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ"
60+
},
61+
{
62+
"url": "https://pkg.go.dev/vuln/GO-2023-1840"
63+
}
64+
],
65+
"credits": [
66+
{
67+
"lang": "en",
68+
"value": "Vincent Dehors from Synacktiv"
69+
}
70+
]
71+
}
72+
}
73+
}

‎data/osv/GO-2023-1840.json

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2023-1840",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2023-29403"
8+
],
9+
"details": "On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors.\n\nIf a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.",
10+
"affected": [
11+
{
12+
"package": {
13+
"name": "toolchain",
14+
"ecosystem": "Go"
15+
},
16+
"ranges": [
17+
{
18+
"type": "SEMVER",
19+
"events": [
20+
{
21+
"introduced": "0"
22+
},
23+
{
24+
"fixed": "1.19.10"
25+
},
26+
{
27+
"introduced": "1.20.0-0"
28+
},
29+
{
30+
"fixed": "1.20.5"
31+
}
32+
]
33+
}
34+
],
35+
"ecosystem_specific": {
36+
"imports": [
37+
{
38+
"path": "cmd/go"
39+
}
40+
]
41+
}
42+
}
43+
],
44+
"references": [
45+
{
46+
"type": "REPORT",
47+
"url": "https://go.dev/issue/60272"
48+
},
49+
{
50+
"type": "FIX",
51+
"url": "https://go.dev/cl/501223"
52+
},
53+
{
54+
"type": "WEB",
55+
"url": "https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ"
56+
}
57+
],
58+
"credits": [
59+
{
60+
"name": "Vincent Dehors from Synacktiv"
61+
}
62+
],
63+
"database_specific": {
64+
"url": "https://pkg.go.dev/vuln/GO-2023-1840"
65+
}
66+
}

‎data/reports/GO-2023-1840.yaml

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
id: GO-2023-1840
2+
modules:
3+
- module: cmd
4+
versions:
5+
- fixed: 1.19.10
6+
- introduced: 1.20.0-0
7+
fixed: 1.20.5
8+
vulnerable_at: 1.20.4
9+
packages:
10+
- package: cmd/go
11+
summary: Unsafe behavior in setuid/setgid binaries in Go runtime
12+
description: |
13+
On Unix platforms, the Go runtime does not behave differently when a binary
14+
is run with the setuid/setgid bits. This can be dangerous in certain
15+
cases, such as when dumping memory state, or assuming the status of
16+
standard i/o file descriptors.
17+
18+
If a setuid/setgid binary is executed with standard I/O file descriptors
19+
closed, opening any files can result in unexpected content being read
20+
or written with elevated privileges. Similarly, if a setuid/setgid program
21+
is terminated, either via panic or signal, it may leak the contents of its
22+
registers.
23+
credits:
24+
- Vincent Dehors from Synacktiv
25+
references:
26+
- report: https://go.dev/issue/60272
27+
- fix: https://go.dev/cl/501223
28+
- web: https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
29+
cve_metadata:
30+
id: CVE-2023-29403
31+
cwe: 'CWE-642: External Control of Critical State Data'

0 commit comments

Comments
 (0)