CVE-2022-41716
Estado: ModificadaAlta (7.5)—
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.84%
- Percentil entre todas las CVEs puntuadas: 56
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- NVD-CWE-Other
Referencias
- https://go.dev/cl/446916
- https://go.dev/issue/56284
- https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ
- https://pkg.go.dev/vuln/GO-2022-1095
- https://go.dev/cl/446916
- https://go.dev/issue/56284
- https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ
- https://pkg.go.dev/vuln/GO-2022-1095
- https://security.netapp.com/advisory/ntap-20230120-0007/
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-41716",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-41716",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-08-01T14:02:04.861393Z"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 3.4,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security@golang.org",
"affectedData": [
{
"vendor": "Go standard library",
"product": "syscall",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.18.8",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.19.0-0",
"lessThan": "1.19.3",
"versionType": "semver"
}
],
"platforms": [
"windows"
],
"packageName": "syscall",
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "StartProcess"
}
]
},
{
"vendor": "Go standard library",
"product": "os/exec",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.18.8",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.19.0-0",
"lessThan": "1.19.3",
"versionType": "semver"
}
],
"platforms": [
"windows"
],
"packageName": "os/exec",
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "Cmd.environ"
},
{
"name": "dedupEnv"
},
{
"name": "dedupEnvCase"
},
{
"name": "Cmd.CombinedOutput"
},
{
"name": "Cmd.Environ"
},
{
"name": "Cmd.Output"
},
{
"name": "Cmd.Run"
},
{
"name": "Cmd.Start"
}
]
}
]
}
],
"published": "2022-11-02T16:15:11.150",
"references": [
{
"url": "https://go.dev/cl/446916",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "security@golang.org"
},
{
"url": "https://go.dev/issue/56284",
"tags": [
"Issue Tracking",
"Patch",
"Vendor Advisory"
],
"source": "security@golang.org"
},
{
"url": "https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ",
"tags": [
"Patch",
"Release Notes",
"Vendor Advisory"
],
"source": "security@golang.org"
},
{
"url": "https://pkg.go.dev/vuln/GO-2022-1095",
"tags": [
"Vendor Advisory"
],
"source": "security@golang.org"
},
{
"url": "https://go.dev/cl/446916",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://go.dev/issue/56284",
"tags": [
"Issue Tracking",
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ",
"tags": [
"Patch",
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://pkg.go.dev/vuln/GO-2022-1095",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230120-0007/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string \"A=B\\x00C=D\" sets the variables \"A=B\" and \"C=D\"."
},
{
"lang": "es",
"value": "Debido a valores NUL no sanitizados, los atacantes pueden configurar variables de entorno de forma maliciosa en Windows. En syscall.StartProcess y os/exec.Cmd, los valores de variables de entorno no válidos que contienen valores NUL no se verifican correctamente. Un valor de variable de entorno malicioso puede aprovechar este comportamiento para establecer un valor para una variable de entorno diferente. Por ejemplo, la cadena de variable de entorno \"A=B\\x00C=D\" establece las variables \"A=B\" y \"C=D\"."
}
],
"lastModified": "2026-06-17T05:03:41.997",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "38EFB36B-50AE-41B5-A036-EBE041702AF7",
"versionEndExcluding": "1.18.8"
},
{
"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D3E7F5D0-6DE2-4D7E-AF0A-04C4BE7F512D",
"versionEndExcluding": "1.19.3",
"versionStartIncluding": "1.19.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "security@golang.org"
}