Vulnerability Description
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Golang | Go | < 1.10.6 |
| Opensuse | Backports Sle | 15.0 |
| Opensuse | Leap | 15.0 |
| Suse | Linux Enterprise Server | 12 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.htmlMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/106228Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16874Issue TrackingThird Party Advisory
- https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0
- https://lists.debian.org/debian-lts-announce/2021/03/msg00014.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00015.htmlMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/201812-09MitigationThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.htmlMailing ListThird Party Advisory
FAQ
What is CVE-2018-16874?
CVE-2018-16874 is a vulnerability with a CVSS score of 8.1 (HIGH). In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '...
How severe is CVE-2018-16874?
CVE-2018-16874 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-16874?
Check the references section above for vendor advisories and patch information. Affected products include: Golang Go, Opensuse Backports Sle, Opensuse Leap, Suse Linux Enterprise Server, Debian Debian Linux.