GHSA-68g3-2p3g-w9pq

GHSA-68g3-2p3g-w9pq PUBLISHED CVSS 9.800000190734863 CRITICAL

Record from GitHub Advisory Database · Published June 8, 2023

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
falco	Wolfi	0.37.1-r0
kubeflow-katib	Wolfi	0.19.0-r40, 0.19.0-r31
kind	Wolfi	0.21.0-r0
falco	Chainguard	0.37.1-r0
policy-controller	Wolfi	0.7.0-r4
kubeflow-katib	Chainguard	0.19.0-r31
policy-controller	Chainguard	0.7.0-r4
kind	Chainguard	0.21.0-r0

Risk scores

CVSS 3.1

9.800000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
wolfi	falco	0
wolfi	kubeflow-katib	0, 0
wolfi	kind	0
chainguard	falco	0
wolfi	policy-controller	0
chainguard	kubeflow-katib	0
chainguard	policy-controller	0
chainguard	kind	0

Timeline

Jun 8, 2023 CVE Published
May 1, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-68g3-2p3g-w9pq
vulnetix vdb fixes GHSA-68g3-2p3g-w9pq

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-68g3-2p3g-w9pq/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →