FlawAtlas
Search the atlas
UBUNTU-CVE-2023-24531 Critical

UBUNTU-CVE-2023-24531

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.

Exploit probability Not scored
Published July 2, 2024
Required by Not available
Last source change May 20, 2026

02 / AFFECTED SOFTWARE

Affected packages

Ubuntu:14.04:LTS golang-1.10

1 explicit affected versions

Ubuntu:16.04:LTS golang-1.10

2 explicit affected versions

Ubuntu:16.04:LTS golang-1.6

10 explicit affected versions

Ubuntu:18.04:LTS golang-1.10

8 explicit affected versions

Ubuntu:18.04:LTS golang-1.8

2 explicit affected versions

Ubuntu:18.04:LTS golang-1.9

5 explicit affected versions

Ubuntu:20.04:LTS golang-1.13

10 explicit affected versions

Ubuntu:20.04:LTS golang-1.14

9 explicit affected versions

Ubuntu:20.04:LTS golang-1.18

2 explicit affected versions

Ubuntu:20.04:LTS golang-1.20

2 explicit affected versions

Ubuntu:20.04:LTS golang-1.21

3 explicit affected versions

Ubuntu:22.04:LTS golang-1.17

4 explicit affected versions

Ubuntu:22.04:LTS golang-1.18

7 explicit affected versions

Ubuntu:22.04:LTS golang-1.20

2 explicit affected versions

Ubuntu:22.04:LTS golang-1.21

3 explicit affected versions

Ubuntu:24.04:LTS golang-1.21

11 explicit affected versions

Ubuntu:Pro:16.04:LTS golang-1.13

4 explicit affected versions

Ubuntu:Pro:16.04:LTS golang-1.18

1 explicit affected versions

Ubuntu:Pro:18.04:LTS golang-1.13

4 explicit affected versions

Ubuntu:Pro:18.04:LTS golang-1.16

2 explicit affected versions

Ubuntu:Pro:18.04:LTS golang-1.18

2 explicit affected versions

Ubuntu:Pro:20.04:LTS golang-1.16

3 explicit affected versions

Ubuntu:Pro:22.04:LTS golang-1.13

4 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities UBUNTU-CVE-2023-24531

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.

View original source

05 / REFERENCES

Further evidence