{
  "threat_severity" : "Moderate",
  "public_date" : "2023-06-08T00:00:00Z",
  "bugzilla" : {
    "description" : "golang: cmd/go: go command may generate unexpected code at build time when using cgo",
    "id" : "2217562",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2217562"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-94",
  "details" : [ "The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via \"go get\", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).", "A flaw was found in golang. The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program that uses cgo. This can occur when running an untrusted module that contains directories with newline characters in their names. Modules that are retrieved using the go command, for example, via \"go get\", are not affected. Modules retrieved using GOPATH-mode, for example, GO111MODULE=off may be affected." ],
  "statement" : "This vulnerability is only applicable to customer use of the go compiler and not any pre-compiled golang binaries shipped by Red Hat.",
  "affected_release" : [ {
    "product_name" : "Red Hat Ceph Storage 5.3",
    "release_date" : "2024-06-26T00:00:00Z",
    "advisory" : "RHSA-2024:4119",
    "cpe" : "cpe:/a:redhat:ceph_storage:5.3::el8",
    "package" : "rhceph/keepalived-rhel8:2.1.5-42"
  }, {
    "product_name" : "Red Hat Ceph Storage 5.3",
    "release_date" : "2024-06-26T00:00:00Z",
    "advisory" : "RHSA-2024:4119",
    "cpe" : "cpe:/a:redhat:ceph_storage:5.3::el8",
    "package" : "rhceph/rhceph-5-dashboard-rhel8:5-87"
  }, {
    "product_name" : "Red Hat Ceph Storage 5.3",
    "release_date" : "2024-06-26T00:00:00Z",
    "advisory" : "RHSA-2024:4119",
    "cpe" : "cpe:/a:redhat:ceph_storage:5.3::el8",
    "package" : "rhceph/rhceph-5-rhel8:5-519"
  }, {
    "product_name" : "Red Hat Ceph Storage 5.3",
    "release_date" : "2024-06-26T00:00:00Z",
    "advisory" : "RHSA-2024:4119",
    "cpe" : "cpe:/a:redhat:ceph_storage:5.3::el8",
    "package" : "rhceph/rhceph-haproxy-rhel8:2.2.19-35"
  }, {
    "product_name" : "Red Hat Ceph Storage 5.3",
    "release_date" : "2024-06-26T00:00:00Z",
    "advisory" : "RHSA-2024:4119",
    "cpe" : "cpe:/a:redhat:ceph_storage:5.3::el8",
    "package" : "rhceph/snmp-notifier-rhel8:1.2.1-69"
  }, {
    "product_name" : "Red Hat Developer Tools",
    "release_date" : "2023-06-29T00:00:00Z",
    "advisory" : "RHSA-2023:3920",
    "cpe" : "cpe:/a:redhat:devtools:2023::el7",
    "package" : "go-toolset-1.19-0:1.19.10-1.el7_9"
  }, {
    "product_name" : "Red Hat Developer Tools",
    "release_date" : "2023-06-29T00:00:00Z",
    "advisory" : "RHSA-2023:3920",
    "cpe" : "cpe:/a:redhat:devtools:2023::el7",
    "package" : "go-toolset-1.19-golang-0:1.19.10-1.el7_9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2023-06-29T00:00:00Z",
    "advisory" : "RHSA-2023:3922",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "go-toolset:rhel8-8080020230627164522.6b4b45d8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-06-29T00:00:00Z",
    "advisory" : "RHSA-2023:3923",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "golang-0:1.19.10-1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-06-29T00:00:00Z",
    "advisory" : "RHSA-2023:3923",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "go-toolset-0:1.19.10-1.el9_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Ceph Storage 3",
    "fix_state" : "Will not fix",
    "package_name" : "golang",
    "cpe" : "cpe:/a:redhat:ceph_storage:3"
  }, {
    "product_name" : "Red Hat Storage 3",
    "fix_state" : "Will not fix",
    "package_name" : "golang",
    "cpe" : "cpe:/a:redhat:storage:3"
  }, {
    "product_name" : "Red Hat Storage 3",
    "fix_state" : "Will not fix",
    "package_name" : "go-toolset-7-golang",
    "cpe" : "cpe:/a:redhat:storage:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-29402\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-29402\nhttps://go.dev/cl/501226\nhttps://go.dev/issue/60167\nhttps://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ\nhttps://pkg.go.dev/vuln/GO-2023-1839" ],
  "name" : "CVE-2023-29402",
  "csaw" : false
}