CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2021-3115
High (7.5). EPSS 6.9% chance of exploitation in the next 30 days. Fixed in toolchain 1.14.14, 1.15.7.
Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).
Severity
- EPSS
- 6.9% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-427
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- golang:go
- netapp:cloud_insights_telegraf_agent
- netapp:storagegrid
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GO-2021-0068 | Go | toolchain | <1.14.14 >=1.15.0-0 <1.15.7 | 1.14.14, 1.15.7 |
References
- https://blog.golang.org/path-security
- https://groups.google.com/g/golang-announce/c/mperVMGa98w
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWAYJGXWC232SG3UR3TR574E6BP3OSQQ/
- https://security.gentoo.org/glsa/202208-02
- https://security.netapp.com/advisory/ntap-20210219-0001/