CVE-2023-39323

Publication date 5 October 2023

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
golang-1.19	24.04 LTS noble	Not in release
	23.10 mantic	Not in release
	23.04 lunar	Ignored
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Not in release
	18.04 LTS bionic	Ignored
	16.04 LTS xenial	Ignored
	14.04 LTS trusty	Ignored
golang-1.20	24.04 LTS noble	Not in release
	23.10 mantic	Fixed 1.20.8-1ubuntu0.23.10.1
	23.04 lunar	Fixed 1.20.3-1ubuntu0.2
	22.04 LTS jammy	Fixed 1.20.3-1ubuntu0.1~22.04.1
	20.04 LTS focal	Fixed 1.20.3-1ubuntu0.1~20.04.1
	18.04 LTS bionic	Ignored
	16.04 LTS xenial	Ignored
	14.04 LTS trusty	Ignored
golang-1.21	24.04 LTS noble	Not affected
	23.10 mantic	Fixed 1.21.1-1ubuntu0.23.10.1
	23.04 lunar	Fixed 1.21.1-1~ubuntu23.04.2
	22.04 LTS jammy	Fixed 1.21.1-1~ubuntu22.04.2
	20.04 LTS focal	Fixed 1.21.1-1~ubuntu20.04.2
	18.04 LTS bionic	Ignored
	16.04 LTS xenial	Ignored
	14.04 LTS trusty	Ignored

Severity score breakdown

Parameter	Value
Base score	8.1 · High
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)