[go/release-branch.go1.24] [release-branch.go1.24] cmd/go/internal/work: sanitize flags before invoking 'pkg-config'
0 views
Skip to first unread message
Gopher Robot (Gerrit)
Jan 15, 2026, 1:14:24 PM (3 days ago) Jan 15
to Michael Pratt, Neal Patel, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Junyang Shao, golang-co...@googlegroups.com
Gopher Robot submitted the change![]( "Open in Gerrit")
Change information
Commit message:
[release-branch.go1.24] cmd/go/internal/work: sanitize flags before invoking 'pkg-config'
The addition of CgoPkgConfig allowed execution with flags not
matching the safelist. In order to prevent potential arbitrary
code execution at build time, ensure that flags are validated
prior to invoking the 'pkg-config' binary.
Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc.
for reporting this issue.
Fixes CVE-2025-61731
Fixes #77100
Change-Id: Ic51b41f1f7e697ab98c9c32c6fae35f217f7f364
Reviewed-by: Nicholas Husin <hu...@google.com>
Reviewed-by: Damien Neil <dn...@google.com>
Reviewed-by: Neal Patel <neal...@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/736701
Auto-Submit: Michael Pratt <mpr...@google.com>
TryBot-Bypass: Michael Pratt <mpr...@google.com>
Reviewed-by: Junyang Shao <shaoj...@google.com>
Files:
- M src/cmd/go/internal/work/exec.go
- M src/cmd/go/internal/work/security.go
Change size: XS
Delta: 2 files changed, 9 insertions(+), 0 deletions(-)
Branch: refs/heads/release-branch.go1.24
Submit Requirements:
Code-Review: +2 by Junyang Shao
TryBots-Pass: TryBot-Bypass+1 by Michael Pratt
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Gopher Robot (Gerrit)
Jan 15, 2026, 1:14:40 PM (3 days ago) Jan 15
to Michael Pratt, Neal Patel, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Junyang Shao, golang-co...@googlegroups.com
Gopher Robot submitted the change![]( "Open in Gerrit")
Change information
Commit message:
[release-branch.go1.26] cmd/go/internal/work: sanitize flags before invoking 'pkg-config'
The addition of CgoPkgConfig allowed execution with flags not
matching the safelist. In order to prevent potential arbitrary
code execution at build time, ensure that flags are validated
prior to invoking the 'pkg-config' binary.
Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc.
for reporting this issue.
Fixes CVE-2025-61731
Fixes #77100
Change-Id: Ic51b41f1f7e697ab98c9c32c6fae35f217f7f364
Reviewed-by: Nicholas Husin <hu...@google.com>
Reviewed-by: Damien Neil <dn...@google.com>
Reviewed-by: Neal Patel <neal...@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/736706
Auto-Submit: Michael Pratt <mpr...@google.com>
Reviewed-by: Junyang Shao <shaoj...@google.com>
TryBot-Bypass: Michael Pratt <mpr...@google.com>
Files:
- M src/cmd/go/internal/work/exec.go
- M src/cmd/go/internal/work/security.go
Change size: XS
Delta: 2 files changed, 9 insertions(+), 0 deletions(-)
Branch: refs/heads/release-branch.go1.26
Submit Requirements:
Code-Review: +2 by Junyang Shao
TryBots-Pass: TryBot-Bypass+1 by Michael Pratt
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Gopher Robot (Gerrit)
Jan 15, 2026, 1:14:59 PM (3 days ago) Jan 15
to Michael Pratt, Neal Patel, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Junyang Shao, golang-co...@googlegroups.com
Gopher Robot submitted the change![]( "Open in Gerrit")
Change information
Commit message:
[release-branch.go1.25] cmd/go/internal/work: sanitize flags before invoking 'pkg-config'
The addition of CgoPkgConfig allowed execution with flags not
matching the safelist. In order to prevent potential arbitrary
code execution at build time, ensure that flags are validated
prior to invoking the 'pkg-config' binary.
Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc.
for reporting this issue.
Fixes CVE-2025-61731
Fixes #77100
Change-Id: Ic51b41f1f7e697ab98c9c32c6fae35f217f7f364
Reviewed-by: Nicholas Husin <hu...@google.com>
Reviewed-by: Damien Neil <dn...@google.com>
Reviewed-by: Neal Patel <neal...@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/736722
TryBot-Bypass: Michael Pratt <mpr...@google.com>
Auto-Submit: Michael Pratt <mpr...@google.com>
Reviewed-by: Junyang Shao <shaoj...@google.com>
Files:
- M src/cmd/go/internal/work/exec.go
- M src/cmd/go/internal/work/security.go
Change size: XS
Delta: 2 files changed, 9 insertions(+), 0 deletions(-)
Branch: refs/heads/release-branch.go1.25
Submit Requirements:
Code-Review: +2 by Junyang Shao
TryBots-Pass: TryBot-Bypass+1 by Michael Pratt
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Gopher Robot (Gerrit)
Jan 15, 2026, 1:35:58 PM (3 days ago) Jan 15
to Michael Pratt, Neal Patel, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Go LUCI, Junyang Shao, golang-co...@googlegroups.com
Gopher Robot submitted the change![]( "Open in Gerrit")
Change information
Commit message:
cmd/go/internal/work: sanitize flags before invoking 'pkg-config'
The addition of CgoPkgConfig allowed execution with flags not
matching the safelist. In order to prevent potential arbitrary
code execution at build time, ensure that flags are validated
prior to invoking the 'pkg-config' binary.
Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc.
for reporting this issue.
Fixes CVE-2025-61731
Fixes #77100
Change-Id: Ic51b41f1f7e697ab98c9c32c6fae35f217f7f364
Reviewed-by: Nicholas Husin <hu...@google.com>
Reviewed-by: Damien Neil <dn...@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/736711
Reviewed-by: Junyang Shao <shaoj...@google.com>
Auto-Submit: Michael Pratt <mpr...@google.com>
LUCI-TryBot-Result: Go LUCI <golang...@luci-project-accounts.iam.gserviceaccount.com>
Files:
- M src/cmd/go/internal/work/exec.go
- M src/cmd/go/internal/work/security.go
Change size: XS
Delta: 2 files changed, 9 insertions(+), 0 deletions(-)
Branch: refs/heads/master
Submit Requirements:
Code-Review: +2 by Junyang Shao
TryBots-Pass: LUCI-TryBot-Result+1 by Go LUCI
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Reply all
Reply to author
Forward
0 new messages