go1.20 (SUSE:Linux Enterprise Module for Development Tools 15 SP5) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Development Tools 15 SP5 package go1.20, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (15)

• CVE-2023-29404 — CVSS 9.8 (critical): The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when…
• CVE-2023-29405 — CVSS 9.8 (critical): The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when…
• CVE-2023-29402 — CVSS 9.8 (critical): The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program…
• CVE-2023-39323 — CVSS 8.1 (high): Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to…
• CVE-2023-29403 — CVSS 7.8 (high): On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in…
• CVE-2023-45285 — CVSS 7.5 (high): Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is…
• CVE-2023-39325 — CVSS 7.5 (high): A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While…
• CVE-2023-44487 — CVSS 7.5 (high) — actively exploited: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly…
• CVE-2023-45283 — CVSS 7.5 (high): The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device…
• CVE-2023-29406 — CVSS 6.5 (medium): The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers…
• CVE-2023-39318 — CVSS 6.1 (medium): The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts…
• CVE-2023-39319 — CVSS 6.1 (medium): The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals…
• CVE-2023-39326 — CVSS 5.3 (medium): A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from…
• CVE-2023-45284 — CVSS 5.3 (medium): On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as…
• CVE-2023-29409 — CVSS 5.3 (medium): Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the…