IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.8Alta

CVE-2025-61731Arbitrary file write using cgo pkg-config directive in cmd/go

Go toolchain cmd/go; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 8 Publicada: (hace 9 meses)

Descripción

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.

Debilidad (CWE): CWE-78CWE-88

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
Go toolchain cmd/go < 1.24.12, 1.25.0 – < 1.25.6
golang go < 1.24.12
openshift 4.12 —
openshift 4.13 —
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support all versions
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On all versions
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support all versions
Red Hat Red Hat Hardened Images all versions
Red Hat Red Hat OpenShift Container Platform 4.12 all versions

Referencias y parches

Coincidencias CPE (NVD) (2)
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* < 1.24.12
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* ≥ 1.25.0 < 1.25.6

CVE recientes del mismo producto — Go

Sin puntuación
CVE-2026-97054

HTTP/1 server crash due to MaxBytesReader header race in net/http

Go standard library net/http

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes …