NetSight
IP …
high8.1

CVE-2018-16874

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go pa…

Impact

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

Affected products

VendorProductAffected versions
GolangGo
before 1.10.6
from 1.11.0 before 1.11.3
OpensuseBackports Sle
Version 15.0
OpensuseLeap
Versions 15.0, 15.1, 42.3
SuseLinux Enterprise Server
Version 12
DebianDebian Linux
Version 9.0

Weakness classification

CWE-20CWE-22

References