CVE catalog

CVE-2022-41716

golang-1.19: CVE-2022-41716

[CVE catalog]

Severity
Low · CVSS 0CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.85% · Oct 25, 2026

Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-1.19bookworm1.19.8-2fixed
Ubuntugolang-1.1014.041.10.4-2ubuntu1~14.04.1vulnerable
Ubuntugolang-1.1016.041.10.4-2ubuntu1~16.04.1vulnerable
Ubuntugolang-1.1016.041.10.4-2ubuntu1~16.04.2vulnerable
Ubuntugolang-1.616.041.6-0ubuntu1vulnerable
Ubuntugolang-1.616.041.6-0ubuntu2vulnerable
Ubuntugolang-1.616.041.6-0ubuntu3vulnerable
Ubuntugolang-1.616.041.6-0ubuntu4vulnerable
Ubuntugolang-1.616.041.6-0ubuntu5vulnerable
Ubuntugolang-1.616.041.6.1-0ubuntu1vulnerable
Ubuntugolang-1.616.041.6.2-0ubuntu5~16.04vulnerable
Ubuntugolang-1.616.041.6.2-0ubuntu5~16.04.2vulnerable
Ubuntugolang-1.616.041.6.2-0ubuntu5~16.04.3vulnerable
Ubuntugolang-1.616.041.6.2-0ubuntu5~16.04.4vulnerable
Ubuntugolang-1.13pro1.13.8-1ubuntu2vulnerable
Ubuntugolang-1.13pro1.13.8-1ubuntu2.22.04.1vulnerable
Ubuntugolang-1.13pro1.13.8-1ubuntu2.22.04.1+esm1vulnerable
Ubuntugolang-1.13pro1.13.8-1ubuntu2.22.04.2vulnerable
Ubuntugolang-1.18pro1.18.1-1ubuntu1~18.04.3vulnerable
Ubuntugolang-1.18pro1.18.1-1ubuntu1~18.04.4vulnerable
Ubuntugolang-1.18pro1.18.1-1ubuntu1~18.04.4+esm1vulnerable
Ubuntugolang-1.1018.041.10~rc1-1vulnerable
Ubuntugolang-1.1018.041.10~rc1-1ubuntu1vulnerable
Ubuntugolang-1.1018.041.10~rc1-2ubuntu1vulnerable
Ubuntugolang-1.1018.041.10~rc2-1ubuntu1vulnerable
Ubuntugolang-1.1018.041.10-1ubuntu1vulnerable
Ubuntugolang-1.1018.041.10.1-1ubuntu2vulnerable
Ubuntugolang-1.1018.041.10.4-2ubuntu1~18.04.1vulnerable
Ubuntugolang-1.1018.041.10.4-2ubuntu1~18.04.2vulnerable
Ubuntugolang-1.16pro1.16.2-0ubuntu1~20.04vulnerable
Ubuntugolang-1.16pro1.16.2-0ubuntu1~20.04.1vulnerable
Ubuntugolang-1.16pro1.16.2-0ubuntu1~20.04.1+esm1vulnerable
Ubuntugolang-1.818.041.8.3-2ubuntu1vulnerable
Ubuntugolang-1.818.041.8.3-2ubuntu1.18.04.1vulnerable
Ubuntugolang-1.918.041.9.1-2ubuntu1vulnerable
Ubuntugolang-1.918.041.9.2-1ubuntu1vulnerable
Ubuntugolang-1.918.041.9.2-3ubuntu1vulnerable
Ubuntugolang-1.918.041.9.3-1ubuntu1vulnerable
Ubuntugolang-1.918.041.9.4-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.1-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.3-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.4-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.5-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.6-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.6-2ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.7-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.8-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.8-1ubuntu1.1vulnerable
Ubuntugolang-1.1320.041.13.8-1ubuntu1.2vulnerable
Ubuntugolang-1.1420.041.14~beta1-1vulnerable
Ubuntugolang-1.1420.041.14~beta1-2vulnerable
Ubuntugolang-1.1420.041.14~rc1-1vulnerable
Ubuntugolang-1.1420.041.14-1vulnerable
Ubuntugolang-1.1420.041.14.1-1vulnerable
Ubuntugolang-1.1420.041.14.2-1vulnerable
Ubuntugolang-1.1420.041.14.2-1ubuntu1vulnerable
Ubuntugolang-1.1420.041.14.3-2ubuntu2~20.04.1vulnerable
Ubuntugolang-1.1420.041.14.3-2ubuntu2~20.04.2vulnerable
Ubuntugolang-1.1820.041.18.1-1ubuntu1~20.04.1vulnerable
Ubuntugolang-1.1820.041.18.1-1ubuntu1~20.04.2vulnerable
Ubuntugolang-1.1820.041.18.1-1ubuntu1~20.04.3vulnerable
Ubuntugolang-1.2020.041.20.3-1ubuntu0.1~20.04vulnerable
Ubuntugolang-1.2020.041.20.3-1ubuntu0.1~20.04.1vulnerable
Ubuntugolang-1.1722.041.17-1ubuntu2vulnerable
Ubuntugolang-1.1722.041.17.3-1ubuntu1vulnerable
Ubuntugolang-1.1722.041.17.3-1ubuntu2vulnerable
Ubuntugolang-1.1722.041.17.13-3ubuntu1vulnerable
Ubuntugolang-1.1722.041.17.13-3ubuntu1.2vulnerable
Ubuntugolang-1.1722.041.17.13-3ubuntu1.3vulnerable
Ubuntugolang-1.1822.041.18~beta1-0ubuntu1vulnerable
Ubuntugolang-1.1822.041.18~beta2-1ubuntu1vulnerable
Ubuntugolang-1.1822.041.18~beta2-1ubuntu2vulnerable
Ubuntugolang-1.1822.041.18~rc1-1ubuntu1vulnerable
Ubuntugolang-1.1822.041.18-1ubuntu1vulnerable
Ubuntugolang-1.1822.041.18.1-1ubuntu1vulnerable
Ubuntugolang-1.1822.041.18.1-1ubuntu1.1vulnerable
Ubuntugolang-1.1822.041.18.1-1ubuntu1.2vulnerable
Ubuntugolang-1.1822.041.18.1-1ubuntu1.3vulnerable
Ubuntugolang-1.2022.041.20.3-1ubuntu0.1~22.04vulnerable
Ubuntugolang-1.2022.041.20.3-1ubuntu0.1~22.04.1vulnerable
Susego1.18linux enterprise module for development tools 15 sp31.18.8-150000.1.37.1fixed
Susego1.18linux enterprise module for development tools 15 sp41.18.8-150000.1.37.1fixed
Opensusego1.18leap 15.31.18.8-150000.1.37.1fixed
Opensusego1.18leap 15.41.18.8-150000.1.37.1fixed
Opensusego1.19tumbleweed1.19.3-1.1fixed
Susego1.19linux enterprise module for development tools 15 sp31.19.3-150000.1.15.1fixed
Susego1.19linux enterprise module for development tools 15 sp41.19.3-150000.1.15.1fixed
Opensusego1.19leap 15.31.19.3-150000.1.15.1fixed
Opensusego1.19leap 15.41.19.3-150000.1.15.1fixed
Opensusego1.18tumbleweed1.18.8-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-1.19sourcebookworm1.19.3-1unimportantNot reportedNot reported
Susego1.18rpmlinux enterprise module for development tools 15 sp31.18.8-150000.1.37.1Not reportedSUSE-SU-2022:4055-1Not reported
Susego1.18rpmlinux enterprise module for development tools 15 sp41.18.8-150000.1.37.1Not reportedSUSE-SU-2022:4055-1Not reported
Opensusego1.18rpmleap 15.31.18.8-150000.1.37.1Not reportedSUSE-SU-2022:4055-1Not reported
Opensusego1.18rpmleap 15.41.18.8-150000.1.37.1Not reportedSUSE-SU-2022:4055-1Not reported
Opensusego1.19rpmtumbleweed1.19.3-1.1Not reportedOPENSUSE-SU-2024:12472-1Not reported
Susego1.19rpmlinux enterprise module for development tools 15 sp31.19.3-150000.1.15.1Not reportedSUSE-SU-2022:4054-1Not reported
Susego1.19rpmlinux enterprise module for development tools 15 sp41.19.3-150000.1.15.1Not reportedSUSE-SU-2022:4054-1Not reported
Opensusego1.19rpmleap 15.31.19.3-150000.1.15.1Not reportedSUSE-SU-2022:4054-1Not reported
Opensusego1.19rpmleap 15.41.19.3-150000.1.15.1Not reportedSUSE-SU-2022:4054-1Not reported
Opensusego1.18rpmtumbleweed1.18.8-1.1Not reportedOPENSUSE-SU-2024:12471-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-1.19]Fixed
    Details (2)

    • 1.19.8-2 · all · bookworm

      Fixed · Fixed: 1.19.3-1

      dsa · golang-1.19 · debian · bookworm

    • 1.19.8-2 · all · bookworm

      Fixed · Fixed: 1.19.3-1

      dsa · golang-1.19 · debian · bookworm

  • [golang-1.19-doc]Fixed

    Source package: [golang-1.19]

    Details (2)

    • 1.19.8-2 · all · bookworm

      Fixed · Fixed: 1.19.3-1

      dsa · golang-1.19 · debian · bookworm

    • 1.19.8-2 · all · bookworm

      Fixed · Fixed: 1.19.3-1

      dsa · golang-1.19 · debian · bookworm

  • [golang-1.19-go]Fixed

    Source package: [golang-1.19]

    Details (2)

    • 1.19.8-2 · amd64 · bookworm

      Fixed · Fixed: 1.19.3-1

      dsa · golang-1.19 · debian · bookworm

    • 1.19.8-2 · arm64 · bookworm

      Fixed · Fixed: 1.19.3-1

      dsa · golang-1.19 · debian · bookworm

  • [golang-1.19-src]Fixed

    Source package: [golang-1.19]

    Details (2)

    • 1.19.8-2 · all · bookworm

      Fixed · Fixed: 1.19.3-1

      dsa · golang-1.19 · debian · bookworm

    • 1.19.8-2 · all · bookworm

      Fixed · Fixed: 1.19.3-1

      dsa · golang-1.19 · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]