Path to this page:
Subject: CVS commit: pkgsrc/lang
From: Benny Siegert
Date: 2023-10-07 20:09:35
Message id: 20231007180935.82217FBDB@cvs.NetBSD.org
Log Message:
go120: update to 1.20.9 (security).
cmd/go: line directives allows arbitrary execution during build
"//line" directives can be used to bypass the restrictions on \
"//go:cgo_"
directives, allowing blocked linker and compiler flags to be passed during
compliation. This can result in unexpected execution of arbitrary code when
running "go build". The line directive requires the absolute path of \
the file in
which the directive lives, which makes exploting this issue significantly more
complex.
This is CVE-2023-39323 and Go issue https://go.dev/issue/63211.
View the release notes for more information:
https://go.dev/doc/devel/release#go1.20.9
Files: