CVE-2018-16874

moderate-risk
Published 2018-12-14

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

Do I need to act?

~
5.7% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.1/10 High
NETWORK / HIGH complexity

Affected Products (7)

Go

Affected Vendors

Debian Suse Opensuse Golang

References (24)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
Third Party Advisory http://www.securityfocus.com/bid/106228
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16874
https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0
Mailing List https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html
Mailing List https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html
Mitigation https://security.gentoo.org/glsa/201812-09
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
Third Party Advisory http://www.securityfocus.com/bid/106228
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16874
and 4 more references
47
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 9/34 · Low
Exposure 14/34 · Moderate