GO-2022-0532
Empty Cmd.Path can trigger unintended binary in os/exec on Windows
At a glance
- Published
- Updated
- CVE
- CVE-2022-30580
- Aliases
- BIT-golang-2022-30580
Description
On Windows, executing Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset will unintentionally trigger execution of any binaries in the working directory named either "..com" or "..exe".
Affected packages
| Package | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.17.11, introduced 1.18.0-0, fixed 1.18.3 |
References
- https://go.dev/cl/403759 FIX
- https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345e FIX
- https://go.dev/issue/52574 REPORT
- https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |