In breve
- CVE-2018-16874 è una vulnerabilità ALTO (CVSS 8.1) che riguarda toolchain, go (golang), backports sle (opensuse).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 5.0%, superiore al 92.3% delle vulnerabilità.
- Correzione: aggiornare a 1.11.3, 1.10.6 o successiva.
| Package | Affected versions | Patched versions |
|---|
| toolchain Go | ≥ 1.11.0-0, < 1.11.3< 1.10.6
| 1.11.31.10.6
|
| go | ≥ 1.11.0, < 1.11.3< 1.10.6
| 1.11.31.10.6
|
| backports sle | = 15.0
| No fix yet |
Description
The "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly brace (both '{' and '}' characters).
Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
NVD description
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free