PT-2023-9548 · Go+5 · Go+5

Hunter Wittenborn · Published 2023-08-08 · Updated 2026-05-27 · CVE-2023-24531

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Go (affected versions not specified)

Description The issue is related to the command go env which outputs a shell script containing the Go environment. However, go env does not sanitize the values, allowing for various bad behaviors when its output is executed as a shell script. This can include executing arbitrary commands or inserting new environment variables. The problem is considered relatively minor because an attacker who can set arbitrary environment variables on a system likely has better attack vectors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-138

Related Identifiers

AZL-43104

AZL-43110

AZL-52719

AZL-79036

BDU:2024-08391

BIT-GOLANG-2023-24531

CVE-2023-24531

GO-2024-2962

USN-7061-1

USN-7109-1

Affected Products

Astra Linux

Debian

Go

Linuxmint

Red Os

Ubuntu

References · 53

• 🔥 https://github.com/hex0punk/cont-flood-poc · Exploit
• https://ubuntu.com/security/CVE-2024-24791 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-24538 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43104 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-34155 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-24531 · Security Note
• https://osv.dev/vulnerability/AZL-52719 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24531 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-24531 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7109-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-29406 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-29403 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-24531 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-45290 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-45288 · Vendor Advisory