En resumen
- CVE-2018-16874 es una vulnerabilidad ALTO (CVSS 8.1) que afecta a toolchain, go (golang), backports sle (opensuse).
- Probabilidad de explotación en los próximos 30 días (EPSS): 5.0%, mayor que el 92.3% de las vulnerabilidades.
- Solución: actualizar a 1.11.3, 1.10.6 o posterior.
| Package | Affected versions | Patched versions |
|---|
| toolchain Go | ≥ 1.11.0-0, < 1.11.3< 1.10.6
| 1.11.31.10.6
|
| go | ≥ 1.11.0, < 1.11.3< 1.10.6
| 1.11.31.10.6
|
| backports sle | = 15.0
| No fix yet |
Description
The "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly brace (both '{' and '}' characters).
Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
NVD description
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free