PT-2022-20188 · Google+2 · Go+2

Bk2204 + 4 · Published 2022-06-07 · Updated 2026-03-06 · CVE-2022-30580

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.17.11 Go versions prior to 1.18.3

Description The issue allows for code injection in Cmd.Start in os/exec, enabling the execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset. This occurs on Windows.

Recommendations For Go versions prior to 1.17.11, update to Go 1.17.11 or later to resolve the issue. For Go versions prior to 1.18.3, update to Go 1.18.3 or later to resolve the issue. As a temporary workaround, consider setting Cmd.Path to a specific executable to avoid unintentional execution of binaries in the working directory.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

ALT-PU-2022-2036

ALT-PU-2022-2041

ALT-PU-2022-2873

ALT-PU-2023-1205

AZL-10532

AZL-79108

BIT-GOLANG-2022-30580

CVE-2022-30580

GO-2022-0532

OPENSUSE-SU-2022_2004-1

OPENSUSE-SU-2022_2005-1

OPENSUSE-SU-2024:12123-1

OPENSUSE-SU-2024:12124-1

SUSE-SU-2022:2004-1

SUSE-SU-2022:2005-1

SUSE-SU-2023:2312-1

Affected Products

Alt Linux

Go

Suse

References · 84

• https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345e · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30580 · Security Note
• https://go.dev/cl/403759 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-17956.html · Vendor Advisory
• https://osv.dev/vulnerability/AZL-10532 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/685841 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12123-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2004-1 · Vendor Advisory
• https://pkg.go.dev/vuln/GO-2022-0532 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-17957.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2312-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0532 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-79108 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-golang-2022-30580 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2005-1 · Vendor Advisory