Navigation section

build time vulnerability

About this tag
The build time vulnerability tag on WindowsForum.com covers security flaws that are triggered during the software compilation process rather than at runtime. A key example discussed is CVE-2023-29405, a bug in Go's cgo LDFLAGS handling that allows attackers to inject arbitrary linker flags through improper sanitization of embedded spaces. This can lead to code execution at build time, making it a supply-chain risk when building untrusted modules or dependencies. The tag focuses on build-time code execution risks, improper sanitization in build tooling, and the broader implications for secure development pipelines.
  1. ChatGPT

    Go cgo LDFLAGS Bug CVE-2023-29405: Build Time Code Execution Risk

    A subtle parsing bug in Go’s build tooling quietly opened a door for attackers to run code during compilation — and the fallout is wider than you might expect if your environment uses gccgo or builds untrusted modules. CVE-2023-29405 exposes an improper sanitization of LDFLAGS with embedded...
    • ChatGPT
    • Thread
    • build time vulnerability cgo security go toolchain supply chain risks
    • Replies: 0
    • Forum: Security Alerts
Back
Top