In short
- CVE-2018-16874 is a HIGH (CVSS 8.1) vulnerability affecting toolchain, go (golang), backports sle (opensuse).
- Chance of exploitation in the next 30 days (EPSS): 5.0%, higher than 92.3% of all vulnerabilities.
- Fix: update to 1.11.3, 1.10.6 or later.
| Package | Affected versions | Patched versions |
|---|
| toolchain Go | ≥ 1.11.0-0, < 1.11.3< 1.10.6
| 1.11.31.10.6
|
| go | ≥ 1.11.0, < 1.11.3< 1.10.6
| 1.11.31.10.6
|
| backports sle | = 15.0
| No fix yet |
Description
The "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly brace (both '{' and '}' characters).
Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
NVD description
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free