[GO-2022-1095] Unsanitized NUL in environment variables on Windows in syscall and os/exec

Severity High

Affected Packages 4

Fixed Packages 4

CVEs 1

Due to unsanitized NUL values, attackers may be able to maliciously set
environment variables on Windows.

In syscall.StartProcess and os/exec.Cmd, invalid environment variable values
containing NUL values are not properly checked for. A malicious environment
variable value can exploit this behavior to set a value for a different
environment variable. For example, the environment variable string "A=B\x00C=D"
sets the variables "A=B" and "C=D".

Package	Affected Version
pkg:golang/syscall	>= 1.19.2, < 1.18.8
pkg:golang/syscall	>= 1.19.2, < 1.19.3
pkg:golang/os/exec	>= 1.19.2, < 1.18.8
pkg:golang/os/exec	>= 1.19.2, < 1.19.3

Package	Fixed Version
pkg:golang/syscall	= 1.18.8
pkg:golang/syscall	= 1.19.3
pkg:golang/os/exec	= 1.18.8
pkg:golang/os/exec	= 1.19.3

ID

GO-2022-1095

Severity

high

Severity from

CVE-2022-41716

URL

https://pkg.go.dev/vuln/GO-2022-1095

Published

2022-11-01T19:56:27
(22 months ago)

Modified

2024-07-17T19:54:18
(2 months ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version
Fixed	pkg:golang/syscall		syscall	= 1.18.8
Affected	pkg:golang/syscall		syscall	>= 1.19.2 < 1.18.8
Fixed	pkg:golang/syscall		syscall	= 1.19.3
Affected	pkg:golang/syscall		syscall	>= 1.19.2 < 1.19.3
Fixed	pkg:golang/os/exec	os	exec	= 1.18.8
Affected	pkg:golang/os/exec	os	exec	>= 1.19.2 < 1.18.8
Fixed	pkg:golang/os/exec	os	exec	= 1.19.3
Affected	pkg:golang/os/exec	os	exec	>= 1.19.2 < 1.19.3

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date