CVE-2023-29405

Summary

CVE-2023-29405 is a vulnerability affecting the go command in certain scenarios. When using cgo, the go command may execute arbitrary code during build time. This can occur when running "go get" on a malicious module or using any command that builds untrusted code. The issue is caused by mishandled linker flags specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are not properly sanitized, allowing disallowed flags to be smuggled through by including them in the argument of another flag. This vulnerability only impacts the usage of the gccgo compiler.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.