CVE-2023-39323

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-39323
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

8.1 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://go.dev/cl/533215 Patch
https://go.dev/cl/533215 Patch
https://go.dev/issue/63211 Issue Tracking Patch
https://go.dev/issue/63211 Issue Tracking Patch
https://groups.google.com/g/golang-announce/c/XBa1oHDevAo Mailing List Release Notes
https://groups.google.com/g/golang-announce/c/XBa1oHDevAo Mailing List Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ Mailing List Third Party Advisory
https://pkg.go.dev/vuln/GO-2023-2095 Vendor Advisory
https://pkg.go.dev/vuln/GO-2023-2095 Vendor Advisory
https://security.gentoo.org/glsa/202311-09 Third Party Advisory
https://security.gentoo.org/glsa/202311-09 Third Party Advisory
https://security.netapp.com/advisory/ntap-20231020-0001/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20231020-0001/ Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
History

12 Jun 2025, 16:15

Type Values Removed Values Added
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ - Mailing List, Third Party Advisory () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ - Mailing List, Third Party Advisory
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ - Mailing List, Third Party Advisory () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ - Mailing List, Third Party Advisory
References (MISC) https://groups.google.com/g/golang-announce/c/XBa1oHDevAo - Mailing List, Release Notes () https://groups.google.com/g/golang-announce/c/XBa1oHDevAo - Mailing List, Release Notes
References (MISC) https://go.dev/issue/63211 - Issue Tracking, Patch () https://go.dev/issue/63211 - Issue Tracking, Patch
References (MISC) https://security.netapp.com/advisory/ntap-20231020-0001/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20231020-0001/ - Third Party Advisory
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ - Mailing List, Third Party Advisory () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ - Mailing List, Third Party Advisory
References (MISC) https://pkg.go.dev/vuln/GO-2023-2095 - Vendor Advisory () https://pkg.go.dev/vuln/GO-2023-2095 - Vendor Advisory
References (MISC) https://go.dev/cl/533215 - Patch () https://go.dev/cl/533215 - Patch

04 Jan 2024, 18:04

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 8.1
References () https://security.gentoo.org/glsa/202311-09 - () https://security.gentoo.org/glsa/202311-09 - Third Party Advisory

25 Nov 2023, 11:15

Type Values Removed Values Added
References
  • () https://security.gentoo.org/glsa/202311-09 -

16 Nov 2023, 00:54

Type Values Removed Values Added
References (MISC) https://security.netapp.com/advisory/ntap-20231020-0001/ - (MISC) https://security.netapp.com/advisory/ntap-20231020-0001/ - Third Party Advisory
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ - Mailing List, Third Party Advisory
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ - Mailing List, Third Party Advisory
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ - Mailing List, Third Party Advisory
CPE cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
First Time Fedoraproject fedora
Fedoraproject

03 Nov 2023, 22:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ -

29 Oct 2023, 04:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ -
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ -

20 Oct 2023, 15:15

Type Values Removed Values Added
References
  • (MISC) https://security.netapp.com/advisory/ntap-20231020-0001/ -

13 Oct 2023, 15:03

Type Values Removed Values Added
New CVE
Information

Published : 2023-10-05 21:15

Updated : 2025-06-12 16:15

NVD link : CVE-2023-39323

Mitre link : CVE-2023-39323

JSON object : View

Products Affected

golang

  • go

fedoraproject

  • fedora
CWE
NVD-CWE-noinfo