CVE-2023-29404 Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Identified in Go Command's LDFLAGS Handling Two vulnerabilities, CVE-2023-29405 and CVE-2023-29404, were published on June 8, 2023, affecting the Go programming language's handling of LDFLAGS in the cmd/go tool when using cgo. CVE-2023-29405 involves improper sanitization of LDFLAGS with embedded spaces, while CVE-2023-29404 relates to improper handling of non-optional LDFLAGS. These vulnerabilities could impact developers using Go for building applications. 2 sources 39