CVE catalog

CVE-2024-24787

golang-1.19 affected and fixed versions

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

Severity: Medium · CVSS 6.4CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Published: May 7, 2024, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.77% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "golang-1.19",
      "status": "not affected",
      "release": "bookworm",
      "version": "1.19.8-2"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "golang-1.19",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": [
    {
      "name": "go1.21",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21.10-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.21.10-1.1",
      "provider_record_id": "OPENSUSE-SU-2024:13941-1"
    },
    {
      "name": "go1.22",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.22.3-1.9.1"
            }
          ]
        }
      ],
      "release": "linux enterprise software development kit 12 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.22.3-1.9.1",
      "provider_record_id": "SUSE-SU-2024:1573-1"
    },
    {
      "name": "go1.21",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21.10-150000.1.33.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for development tools 15 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.21.10-150000.1.33.1",
      "provider_record_id": "SUSE-SU-2024:1588-1"
    },
    {
      "name": "go1.21",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21.10-150000.1.33.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15 sp4-espos",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.21.10-150000.1.33.1",
      "provider_record_id": "SUSE-SU-2024:1588-1"
    },
    {
      "name": "go1.21",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21.10-150000.1.33.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15 sp4-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.21.10-150000.1.33.1",
      "provider_record_id": "SUSE-SU-2024:1588-1"
    },
    {
      "name": "go1.21",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21.10-150000.1.33.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 15 sp4-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.21.10-150000.1.33.1",
      "provider_record_id": "SUSE-SU-2024:1588-1"
    },
    {
      "name": "go1.21",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21.10-150000.1.33.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.21.10-150000.1.33.1",
      "provider_record_id": "SUSE-SU-2024:1588-1"
    },
    {
      "name": "go1.21",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21.10-150000.1.33.1"
            }
          ]
        }
      ],
      "release": "leap 15.5",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.21.10-150000.1.33.1",
      "provider_record_id": "SUSE-SU-2024:1588-1"
    },
    {
      "name": "go1.21",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21.10-150000.1.33.1"
            }
          ]
        }
      ],
      "release": "leap 15.6",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.21.10-150000.1.33.1",
      "provider_record_id": "SUSE-SU-2024:1588-1"
    },
    {
      "name": "go1.21",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21.10-1.33.1"
            }
          ]
        }
      ],
      "release": "linux enterprise software development kit 12 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.21.10-1.33.1",
      "provider_record_id": "SUSE-SU-2024:1574-1"
    },
    {
      "name": "go1.22",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.22.3-150000.1.15.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for development tools 15 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.22.3-150000.1.15.1",
      "provider_record_id": "SUSE-SU-2024:1587-1"
    },
    {
      "name": "go1.22",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.22.3-150000.1.15.1"
            }
          ]
        }
      ],
      "release": "leap 15.5",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.22.3-150000.1.15.1",
      "provider_record_id": "SUSE-SU-2024:1587-1"
    },
    {
      "name": "go1.22",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.22.3-150000.1.15.1"
            }
          ]
        }
      ],
      "release": "leap 15.6",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.22.3-150000.1.15.1",
      "provider_record_id": "SUSE-SU-2024:1587-1"
    },
    {
      "name": "go1.22",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.22.3-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.22.3-1.1",
      "provider_record_id": "OPENSUSE-SU-2024:13936-1"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[golang-1.19]Unknown
Details (2)
- 1.19.8-2 · all · bookworm
  Not affected
  dsa · golang-1.19 · debian · bookworm
- 1.19.8-2 · all · bookworm
  Not affected
  dsa · golang-1.19 · debian · bookworm
[golang-1.19-doc]Unknown
Source package: [golang-1.19]
Details (2)
- 1.19.8-2 · all · bookworm
  Not affected
  dsa · golang-1.19 · debian · bookworm
- 1.19.8-2 · all · bookworm
  Not affected
  dsa · golang-1.19 · debian · bookworm
[golang-1.19-go]Unknown
Source package: [golang-1.19]
Details (2)
- 1.19.8-2 · amd64 · bookworm
  Not affected
  dsa · golang-1.19 · debian · bookworm
- 1.19.8-2 · arm64 · bookworm
  Not affected
  dsa · golang-1.19 · debian · bookworm
[golang-1.19-src]Unknown
Source package: [golang-1.19]
Details (2)
- 1.19.8-2 · all · bookworm
  Not affected
  dsa · golang-1.19 · debian · bookworm
- 1.19.8-2 · all · bookworm
  Not affected
  dsa · golang-1.19 · debian · bookworm

[openSUSE Tumbleweed]

[go1.21]Unknown
Source package: [go1.21]
Details (1)
- 1.21.13-11.2 · x86_64 · tumbleweed
  Fixed · Fixed: 1.21.10-1.1
  dsa · go1.21 · opensuse · tumbleweed
[go1.21-doc]Unknown
Source package: [go1.21]
Details (1)
- 1.21.13-11.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.21.10-1.1
  Version impact unknown
  dsa · go1.21 · opensuse · tumbleweed
[go1.21-race]Unknown
Source package: [go1.21]
Details (1)
- 1.21.13-11.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.21.10-1.1
  Version impact unknown
  dsa · go1.21 · opensuse · tumbleweed
[go1.22]Unknown
Source package: [go1.22]
Details (1)
- 1.22.12-7.2 · x86_64 · tumbleweed
  Fixed · Fixed: 1.22.3-1.1
  dsa · go1.22 · opensuse · tumbleweed
[go1.22-doc]Unknown
Source package: [go1.22]
Details (1)
- 1.22.12-7.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.22.3-1.1
  Version impact unknown
  dsa · go1.22 · opensuse · tumbleweed
[go1.22-race]Unknown
Source package: [go1.22]
Details (1)
- 1.22.12-7.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.22.3-1.1
  Version impact unknown
  dsa · go1.22 · opensuse · tumbleweed

Observed: Oct 28, 2026, 4:50:53 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]