Skip to content
Fencer Intel
high 7.5

CVE-2020-28366 json

Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

published 5y ago modified 4mo ago also BIT-golang-2020-28366 , EUVD-2020-20825 , GO-2022-0475

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.3%
EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits
0
none known

Summary

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

Patch / fix

  • bitnami golang 1.14.12, 1.15.5
  • go toolchain 1.14.12, 1.15.5
  • Go toolchain cmd/go 1.14.12, 1.15.5
  • Go toolchain cmd/cgo 1.14.12, 1.15.5
  • golang-1.15 Debian 11 1.15.5-1

debian advisories DEBIAN-CVE-2020-28366

  • delve RHEL 8 1.4.1-1.module+el8.3.0+7840+63dfb1ed
  • golang RHEL 8 1.14.12-1.module+el8.3.0+8784+380394dc
  • go-toolset RHEL 8 1.14.12-1.module+el8.3.0+8784+380394dc
  • golang-bin RHEL 8 1.14.12-1.module+el8.3.0+8784+380394dc
  • golang-src RHEL 8 1.14.12-1.module+el8.3.0+8784+380394dc
  • golang-misc RHEL 8 1.14.12-1.module+el8.3.0+8784+380394dc
  • golang-race RHEL 8 1.14.12-1.module+el8.3.0+8784+380394dc
  • golang-tests RHEL 8 1.14.12-1.module+el8.3.0+8784+380394dc

red hat advisories RHSA-2020:5493RHSA-2021:0145RHSA-2020:5333

  • go1.14 SLE Module for Development Tools 15 SP2, SLE Module for Development Tools 15 SP1 1.14.12-1.26.1
  • go1.15 SLE Module for Development Tools 15 SP2, SLE Module for Development Tools 15 SP1 1.15.5-1.11.1

suse advisories SUSE-SU-2020:3369-1SUSE-SU-2020:3368-1

  • go1.14 openSUSE Tumbleweed 1.14.15-1.6
  • go1.15 openSUSE Tumbleweed 1.15.15-1.2
  • go1.15 openSUSE Leap 15.2 1.15.5-lp152.2.1
  • go1.14 openSUSE Leap 15.2 1.14.12-lp152.2.12.1
  • go1.14 openSUSE Leap 15.1 1.14.12-lp151.22.1

opensuse advisories openSUSE-SU-2024:10807-1openSUSE-SU-2024:10808-1openSUSE-SU-2020:2139-1openSUSE-SU-2020:2067-1openSUSE-SU-2020:2047-1

  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 1.15.5-r0

alpine advisories ALPINE-CVE-2020-28366

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-tensorboard Azure Linux 3.0 2.16.2-1

azure linux advisories AZL-38452

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • go Arch Linux 2:1.15.5-1

arch linux advisories AVG-1278

Is CVE-2020-28366 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-28366 updated cvss 7.5

golang: malicious symbol names can lead to code execution at build time

  • Red Hat OpenShift Serverless knative-eventing knative-eventing
    affected: workaround, no fix available
  • Red Hat Ceph Storage 2 golang, grafana, golang-bin, golang-src Red Hat Ceph Storage 3 golang, golang-bin, golang-src Red Hat Enterprise Linux 7 cpp, gcc, libgo, gcc-go, golang, libgcc, +20 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Openshift Serverless 1.12 openshift-serverless-1/client-kn-rhel8 0.18.4-2, openshift-serverless-1/serving-queue-rhel8 0.18.2-3, openshift-serverless-1/eventing-mtping-rhel8 0.18.6-2, openshift-serverless-1/kourier-control-rhel8 0.18.0-2, openshift-serverless-1/serving-webhook-rhel8 0.18.2-3, openshift-serverless-1/eventing-webhook-rhel8 0.18.6-2, +20 more
    fixed: vendor fix RHSA-2021:0146
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.14 1.14.12-1.el7_9, go-toolset-1.14-build 1.14.12-1.el7_9, go-toolset-1.14-golang 1.14.12-1.el7_9, go-toolset-1.14-runtime 1.14.12-1.el7_9, go-toolset-1.14-golang-bin 1.14.12-1.el7_9, go-toolset-1.14-golang-src 1.14.12-1.el7_9, +3 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.14 1.14.12-1.el7_9, go-toolset-1.14-build 1.14.12-1.el7_9, go-toolset-1.14-golang 1.14.12-1.el7_9, go-toolset-1.14-runtime 1.14.12-1.el7_9, go-toolset-1.14-golang-bin 1.14.12-1.el7_9, go-toolset-1.14-golang-src 1.14.12-1.el7_9, +3 more
    fixed: vendor fix RHSA-2020:5333
  • Red Hat Enterprise Linux AppStream (v. 8) delve 1.4.1-1.module+el8.3.0+7840+63dfb1ed, golang 1.14.12-1.module+el8.3.0+8784+380394dc, go-toolset 1.14.12-1.module+el8.3.0+8784+380394dc, golang-bin 1.14.12-1.module+el8.3.0+8784+380394dc, golang-src 1.14.12-1.module+el8.3.0+8784+380394dc, golang-misc 1.14.12-1.module+el8.3.0+8784+380394dc, +2 more
    fixed: vendor fix RHSA-2020:5493
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 0.18.4-2.el8
    fixed: vendor fix RHSA-2021:0145
  • Red Hat Distributed Tracing Jaeger 1 jaeger-rhel7-operator, jaeger-rhel8-operator, distributed-tracing/jaeger-all-in-one-rhel7, distributed-tracing/jaeger-all-in-one-rhel8 Red Hat OpenShift Service Mesh 1 kiali, servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-galley, servicemesh-citadel, +5 more Red Hat OpenShift Service Mesh 2.0 kiali, servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-istioctl, servicemesh-operator, +2 more Red Hat Ceph Storage 3 grafana, grafana-container, prometheus-node-exporter Red Hat Ceph Storage 4 grafana, rhceph/rhceph-4-dashboard-rhel8 Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more
    +4 more products
    Red Hat OpenShift Container Platform 4 openshift, openshift-clients, openshift-kubelet, openshift-hyperkube, openshift-kube-apiserver, openshift-kube-scheduler, +2 more Red Hat Openshift Container Storage 4 mcg, ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/ocs-must-gather-rhel8, ocs4/rook-ceph-rhel8-operator Red Hat OpenShift Virtualization 2 kubevirt-virtctl Red Hat Storage 3 etcd, heketi, grafana, heketi-client, python-heketi, noobaa-operator-container, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.34% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.14.12
>=1.15.0, <1.15.5
1.14.12
1.15.5
go toolchain
<1.14.12
>=1.15.0-0, <1.15.5
1.14.12
1.15.5

Affected products

  • Go toolchain cmd/go
  • Go toolchain cmd/cgo

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.