Shell Script Execution Vulnerability in Go by Google
CVE-2012-2666

9.8CRITICAL

Key Information:

Vendor

Golang

Status
Go/golang
Vendor
CVE Published:
9 July 2021

What is CVE-2012-2666?

An issue in Go version 1.0.2 arises from the improper handling of temporary files during the execution of the dotest() function in the debug package. This vulnerability allows an attacker to create a temporary file with a predictable name, which is then executed as a shell script, potentially leading to unauthorized command execution on shared machines. Users of this version should take precautions to mitigate this risk.

Affected Version(s)

go/golang go/golang 1.0.2

References

https://www.whitesourcesoftware.com/vulnerability-databas...
x_refsource_MISC
https://bugzilla.suse.com/show_bug.cgi?id=765455
x_refsource_MISC
https://github.com/golang/go/commit/8ac275bb01588a8c0e6c0...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.