CVE-2023-39323

highpriority · track · 33EPSS 0.019 · 80 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.93% (80th) EPSS

CVSS 8.1 · high

Is it mine?

57 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedrhel8/go-toolset@sha256:1438b41a97337f91f08a7f4d6b859cc5232f1defb6067873a0dfe20970774015_ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHEA-2023:7311
Fixedrhel8/go-toolset@sha256:697a8aa186f930077c1f766a56a8bc7c78f052aa55f77e99360d4f3150c525a9_s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHEA-2023:7311
Fixedrhel8/go-toolset@sha256:c5e43b8090e6ed26c86143a4d7e6ff8fb8556485293f1343c1d7522f7e4c01c5_amd64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHEA-2023:7311
Fixedrhel8/go-toolset@sha256:cb8b8324d59b195dd02c71e5368d2022d6eef4d34d1a4bc3a6386656f5ae172a_arm64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHEA-2023:7311
Fixedubi8/go-toolset@sha256:1438b41a97337f91f08a7f4d6b859cc5232f1defb6067873a0dfe20970774015_ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHEA-2023:7311
Fixedubi8/go-toolset@sha256:697a8aa186f930077c1f766a56a8bc7c78f052aa55f77e99360d4f3150c525a9_s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHEA-2023:7311
Fixedubi8/go-toolset@sha256:c5e43b8090e6ed26c86143a4d7e6ff8fb8556485293f1343c1d7522f7e4c01c5_amd64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHEA-2023:7311
Fixedubi8/go-toolset@sha256:cb8b8324d59b195dd02c71e5368d2022d6eef4d34d1a4bc3a6386656f5ae172a_arm64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHEA-2023:7311

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.4–9.8

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.2 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 2.2 · impact 5.9

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-94USCWE-94US

affected products (57)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
F5 BIG-IPall versionscert_bundDEcpe:/a:f5:big-ip:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Gentoo Linuxall versionscert_bundDEcpe:/o:gentoo:linux:-
Golang Go <1.20.9all versionscert_bundDE
Golang Go <1.21.2all versionscert_bundDE
IBM DB2 REST <1.0.0.1158-amd64all versionscert_bundDE
IBM Spectrum Protect Plus <10.1.16.2all versionscert_bundDE
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Splunk Splunk Enterprise <9.0.8all versionscert_bundDE
Splunk Splunk Enterprise <9.1.3all versionscert_bundDE
Splunk Splunk Enterprise <9.1.6all versionscert_bundDE
Splunk Splunk Enterprise <9.2.3all versionscert_bundDE
Splunk Splunk Enterprise <9.3.1all versionscert_bundDE
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Xerox FreeFlow Print Server v7all versionscert_bundDEcpe:/a:xerox:freeflow_print_server:v7
Xerox FreeFlow Print Server v9all versionscert_bundDEcpe:/a:xerox:freeflow_print_server:v9
IBM DB2≤ REST <1.0.0.1158-amd64cert_bundDE
IBM Spectrum Protect Plus< 10.1.16.2cert_bundDE
Splunk Splunk Enterprise< 9.0.8cert_bundDE

showing 20 of 57

advisories (4)

Vendor and ecosystem advisories describing this.

RHEA-2023:7311Red Hat Enhancement Advisory: go-toolset-container bug fix and enhancement update2023-11-16csaf · redhat_csafUS
An update for go-toolset-container is now available for Red Hat Enterprise Linux 8.
WID-SEC-W-2023-2516Golang Go: Mehre SchwachstellenDeutsch2023-09-28csaf · cert_bundDE
Ein Angreifer kann eine Schwachstelle in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
BIT-golang-2023-39323Arbitrary code execution during build via line directives in cmd/go2024-03-06vendor · osvUS
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
GO-2023-2095Arbitrary code execution during build via line directives in cmd/go2023-10-05vendor · osvUS
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund redhat_csaf NVD CVE.org MITRE

published 2023-10-05modified 2026-06-17

references (33)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan