CVE-2021-3115

Name of the Vulnerable Software and Affected Versions: Go versions prior to 1.14.14 Go versions 1.15.x prior to 1.15.7

Description: The issue is related to the incorrect management of code generation in the Go programming language, specifically with the use of the go get command to fetch modules that utilize cgo. This can lead to command injection and remote code execution, allowing a remote attacker to execute arbitrary code. The vulnerability is triggered when the go get command is used to fetch malicious modules or when the code is built, potentially executing a gcc program from an untrusted download.

Recommendations: For Go versions prior to 1.14.14, update to version 1.14.14 or later to resolve the issue. For Go versions 1.15.x prior to 1.15.7, update to version 1.15.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the go get command with cgo until a patch is applied.