Vulnerability CVE-2023-29403: Information
Description
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.
Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| golang | sisyphus | 1.20.5-alt1 | 1.22.4-alt1 | ALT-PU-2023-2086-1 | 323799 | Fixed |
| golang | sisyphus_riscv64 | 1.20.5-alt1 | 1.22.4-alt1 | ALT-PU-2023-4053-1 | - | Fixed |
| golang | p10 | 1.19.10-alt1 | 1.21.11-alt1 | ALT-PU-2023-2090-1 | 323800 | Fixed |
| golang | p9 | 1.19.12-alt1 | 1.15.15-alt1 | ALT-PU-2023-5153-1 | 326713 | Testing |
| golang | c10f1 | 1.19.10-alt1 | 1.21.10-alt1 | ALT-PU-2023-4099-1 | 323910 | Fixed |
| golang | c9f2 | 1.19.12-alt1 | 1.20.13-alt1 | ALT-PU-2023-4785-2 | 323137 | Fixed |
| golang | p11 | 1.20.5-alt1 | 1.22.4-alt1 | ALT-PU-2023-2086-1 | 323799 | Fixed |