En bref
- CVE-2018-16874 est une vulnérabilité ÉLEVÉE (CVSS 8.1) touchant toolchain, go (golang), backports sle (opensuse).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 5.0%, plus élevée que 92.3% des vulnérabilités.
- Correctif : mettre à jour vers 1.11.3, 1.10.6 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| toolchain Go | ≥ 1.11.0-0, < 1.11.3< 1.10.6
| 1.11.31.10.6
|
| go | ≥ 1.11.0, < 1.11.3< 1.10.6
| 1.11.31.10.6
|
| backports sle | = 15.0
| No fix yet |
Description
The "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly brace (both '{' and '}' characters).
Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
NVD description
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free