CVE-2021-3115

HIGH severity · CVSS 7.5 · CWE-427

7.5CVSS HIGH

Summary

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

Impact & exploitability

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionRequired

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)0%

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products we track (1)

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
https://blog.golang.org/path-securityAdvisory
https://blog.golang.org/path-securityAdvisory
https://groups.google.com/g/golang-announce/c/mperVMGa98wAdvisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWAYJGXWC232SG3UR3TR574E6BP3OSQQ/
https://security.gentoo.org/glsa/202208-02Advisory
https://security.netapp.com/advisory/ntap-20210219-0001/Advisory
https://groups.google.com/g/golang-announce/c/mperVMGa98wAdvisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWAYJGXWC232SG3UR3TR574E6BP3OSQQ/