CVE-2022-30580
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.62%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.62% probability · 48th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- golang/go
- Source
- security@golang.org
References
- https://go.dev/cl/403759Vendor Advisory
- https://go.dev/issue/52574Issue Tracking, Third Party Advisory
- https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345eMailing List, Patch, Vendor Advisory
- https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJMailing List, Third Party Advisory
- https://pkg.go.dev/vuln/GO-2022-0532Vendor Advisory
- https://go.dev/cl/403759Vendor Advisory
- https://go.dev/issue/52574Issue Tracking, Third Party Advisory
- https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345eMailing List, Patch, Vendor Advisory
- https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJMailing List, Third Party Advisory
- https://pkg.go.dev/vuln/GO-2022-0532Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.