CVE-2018-16874
Fixed in a distro release EPSS 5%CVSS 6.8
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
Products: golang go, opensuse backports_sle, opensuse leap, suse linux_enterprise_server, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | toolchain | 1.10.6 |
| Go | toolchain | 1.11.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | go | 2:1.11.3-1 |
| Debian 9 | golang-1.7 | 1.7.4-2+deb9u3 |
| Debian 9 | golang-1.8 | 1.8.1-1+deb9u3 |
| SUSE Enterprise Storage 7.1 | docker-stable | 24.0.9_ce-150000.1.25.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | docker-stable | 24.0.9_ce-150000.1.25.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | docker-stable | 24.0.9_ce-150000.1.25.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | docker-stable | 24.0.9_ce-150000.1.25.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | docker-stable | 24.0.9_ce-150000.1.25.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | docker-stable | 24.0.9_ce-150000.1.25.1 |
| SUSE Linux Enterprise Module for Containers 12 | containerd | 1.2.2-16.14.2 |
| SUSE Linux Enterprise Module for Containers 12 | containerd | 1.2.5-16.17.2 |
| SUSE Linux Enterprise Module for Containers 12 | containerd | 1.4.4-16.38.1 |
| SUSE Linux Enterprise Module for Containers 12 | docker | 18.09.6_ce-98.37.1 |
| SUSE Linux Enterprise Module for Containers 12 | docker | 20.10.6_ce-98.66.1 |
| SUSE Linux Enterprise Module for Containers 12 | docker | 18.09.1_ce-98.34.2 |
| SUSE Linux Enterprise Module for Containers 12 | docker-runc | 1.0.0rc6+gitr3748_96ec2177ae84-1.17.2 |
| SUSE Linux Enterprise Module for Containers 12 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-1.23.1 |
| SUSE Linux Enterprise Module for Containers 12 | golang-github-docker-libnetwork | 0.7.0.1+gitr2711_2cfbf9b1f981-16.2 |
| SUSE Linux Enterprise Module for Containers 12 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-19.1 |
| SUSE Linux Enterprise Module for Containers 12 | runc | 1.0.0~rc93-16.8.1 |
| SUSE Linux Enterprise Module for Containers 15 | containerd | 1.2.2-5.9.1 |
| SUSE Linux Enterprise Module for Containers 15 | containerd | 1.1.2-5.6.1 |
| SUSE Linux Enterprise Module for Containers 15 | containerd | 1.2.5-5.13.1 |
| SUSE Linux Enterprise Module for Containers 15 | containerd | 1.1.2-5.3.4 |
| SUSE Linux Enterprise Module for Containers 15 | docker | 18.09.1_ce-6.14.1 |
| SUSE Linux Enterprise Module for Containers 15 | docker | 18.09.0_ce-6.11.2 |
| SUSE Linux Enterprise Module for Containers 15 | docker | 18.06.1_ce-6.8.2 |
| SUSE Linux Enterprise Module for Containers 15 | docker | 18.09.6_ce-6.17.1 |
| SUSE Linux Enterprise Module for Containers 15 | docker-runc | 1.0.0rc6+gitr3748_96ec2177ae84-6.12.1 |
| SUSE Linux Enterprise Module for Containers 15 | docker-runc | 1.0.0rc5+gitr3562_69663f0bd4b6-6.6.1 |
| SUSE Linux Enterprise Module for Containers 15 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-6.18.1 |
| SUSE Linux Enterprise Module for Containers 15 | docker-runc | 1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4 |
| SUSE Linux Enterprise Module for Containers 15 | golang-github-docker-libnetwork | 0.7.0.1+gitr2711_2cfbf9b1f981-4.9.1 |
| SUSE Linux Enterprise Module for Containers 15 | golang-github-docker-libnetwork | 0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5 |
| SUSE Linux Enterprise Module for Containers 15 | golang-github-docker-libnetwork | 0.7.0.1+gitr2704_6da50d197830-4.6.1 |
| SUSE Linux Enterprise Module for Containers 15 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-4.12.1 |
| SUSE Linux Enterprise Module for Containers 15 | helm-mirror | 0.2.1-1.7.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | containerd | 1.2.5-5.13.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | docker | 18.09.6_ce-6.17.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-6.18.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-4.12.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | helm-mirror | 0.2.1-1.7.1 |
| SUSE Linux Enterprise Module for Containers 15 SP6 | docker-stable | 24.0.9_ce-150000.1.25.1 |
| SUSE Linux Enterprise Module for Containers 15 SP7 | docker-stable | 24.0.9_ce-150000.1.25.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | docker-stable | 24.0.9_ce-1.20.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | docker-stable | 24.0.9_ce-150000.1.25.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | docker-stable | 24.0.9_ce-150000.1.25.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | docker-stable | 24.0.9_ce-150000.1.25.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | docker-stable | 24.0.9_ce-1.20.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | docker-stable | 24.0.9_ce-150000.1.25.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | docker-stable | 24.0.9_ce-150000.1.25.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | docker-stable | 24.0.9_ce-150000.1.25.1 |
| SUSE OpenStack Cloud 6-LTSS | containerd | 1.2.2-16.14.2 |
| SUSE OpenStack Cloud 6-LTSS | docker | 18.09.1_ce-98.34.2 |
| SUSE OpenStack Cloud 6-LTSS | docker-runc | 1.0.0rc6+gitr3748_96ec2177ae84-1.17.2 |
| SUSE OpenStack Cloud 6-LTSS | golang-github-docker-libnetwork | 0.7.0.1+gitr2711_2cfbf9b1f981-16.2 |
| SUSE Package Hub 12 SP3 | helm | 2.13.1-5.1 |
| SUSE Package Hub 15 | go | 1.12-bp150.2.6.1 |
| SUSE Package Hub 15 | runc | 1.0.0~rc6-bp150.2.3.1 |
| Ubuntu 14.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.6 | no fix |
| Ubuntu 18.04 LTS | golang-1.10 | no fix |
| Ubuntu 18.04 LTS | golang-1.8 | no fix |
| Ubuntu 18.04 LTS | golang-1.9 | no fix |
| openSUSE Leap 15.0 | containerd | 1.2.5-lp150.4.14.3 |
| openSUSE Leap 15.0 | docker | 18.09.6_ce-lp150.5.17.2 |
| openSUSE Leap 15.0 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-lp150.5.21.2 |
| openSUSE Leap 15.0 | go | 1.12-lp150.2.11.1 |
| openSUSE Leap 15.0 | go1.11 | 1.11.9-lp150.9.3 |
| openSUSE Leap 15.0 | go1.12 | 1.12.4-lp150.2.2 |
| openSUSE Leap 15.0 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-lp150.3.14.1 |
| openSUSE Leap 15.1 | containerd | 1.2.5-lp151.2.3.1 |
| openSUSE Leap 15.1 | cri-o | 1.17.1-lp151.2.2 |
| openSUSE Leap 15.1 | cri-tools | 1.18.0-lp151.2.1 |
| openSUSE Leap 15.1 | docker | 18.09.6_ce-lp151.2.3.1 |
| openSUSE Leap 15.1 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-lp151.3.3.1 |
| openSUSE Leap 15.1 | go | 1.12-lp151.2.3.1 |
| openSUSE Leap 15.1 | go1.11 | 1.11.9-lp151.2.3.1 |
| openSUSE Leap 15.1 | go1.12 | 1.12.4-lp151.2.3.1 |
| openSUSE Leap 15.1 | go1.14 | 1.14-lp151.6.1 |
| openSUSE Leap 15.1 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-lp151.2.3.1 |
| openSUSE Leap 15.1 | kubernetes | 1.18.0-lp151.5.1 |
| openSUSE Leap 15.5 | etcd | 3.5.12-150000.7.6.1 |
| openSUSE Leap 15.6 | docker-stable | 24.0.9_ce-150000.1.25.1 |
| openSUSE Leap 15.6 | etcd | 3.5.12-150000.7.6.1 |
| openSUSE Tumbleweed | containerd | 1.4.8-2.2 |
| openSUSE Tumbleweed | cri-o | 1.22.0-1.2 |
| openSUSE Tumbleweed | docker | 20.10.6_ce-2.1 |
| openSUSE Tumbleweed | docker-stable | 24.0.9_ce-15.1 |
| openSUSE Tumbleweed | etcd | 3.4.16-3.1 |
| openSUSE Tumbleweed | flannel | 0.14.0-1.2 |
| openSUSE Tumbleweed | go | 1.17-1.1 |
| openSUSE Tumbleweed | go1.10 | 1.10.8-8.2 |
| openSUSE Tumbleweed | go1.11 | 1.11.13-10.5 |
| openSUSE Tumbleweed | go1.12 | 1.12.17-4.8 |
| openSUSE Tumbleweed | helm | 3.6.3-1.1 |
| openSUSE Tumbleweed | helm-mirror | 0.3.1-1.9 |
| openSUSE Tumbleweed | helm3 | 3.19.2-1.1 |
| openSUSE Tumbleweed | runc | 1.0.2-1.2 |