CVE-2018-6574
Fixed in a distro release EPSS 8%
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.
Products: golang go, debian_linux, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_eus, redhat enterprise_linux_server_tus
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | toolchain | 1.8.7 |
| Go | toolchain | 1.9.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | golang | 1.9.4-1.amzn2 |
| Amazon Linux 2 | golang-bin | 1.9.4-1.amzn2 |
| Amazon Linux 2 | golang-docs | 1.9.4-1.amzn2 |
| Amazon Linux 2 | golang-misc | 1.9.4-1.amzn2 |
| Amazon Linux 2 | golang-src | 1.9.4-1.amzn2 |
| Amazon Linux 2 | golang-tests | 1.9.4-1.amzn2 |
| Arch Linux | go | 1.9.4-1 |
| Debian 9 | golang-1.8 | 1.8.1-1+deb9u1 |
| Red Hat devtools 2018 | go-toolset-7 | 0:1.8-14.el7 |
| Red Hat devtools 2018 | go-toolset-7-build | 0:1.8-14.el7 |
| Red Hat devtools 2018 | go-toolset-7-golang | 0:1.8.7-2.el7 |
| Red Hat devtools 2018 | go-toolset-7-golang-bin | 0:1.8.7-2.el7 |
| Red Hat devtools 2018 | go-toolset-7-golang-docs | 0:1.8.7-2.el7 |
| Red Hat devtools 2018 | go-toolset-7-golang-misc | 0:1.8.7-2.el7 |
| Red Hat devtools 2018 | go-toolset-7-golang-race | 0:1.8.7-2.el7 |
| Red Hat devtools 2018 | go-toolset-7-golang-src | 0:1.8.7-2.el7 |
| Red Hat devtools 2018 | go-toolset-7-golang-tests | 0:1.8.7-2.el7 |
| Red Hat devtools 2018 | go-toolset-7-runtime | 0:1.8-14.el7 |
| Red Hat devtools 2018 | go-toolset-7-scldevel | 0:1.8-14.el7 |
| Red Hat Enterprise Linux 7 | golang | 0:1.9.4-1.el7 |
| Red Hat Enterprise Linux 7 | golang-bin | 0:1.9.4-1.el7 |
| Red Hat Enterprise Linux 7 | golang-docs | 0:1.9.4-1.el7 |
| Red Hat Enterprise Linux 7 | golang-misc | 0:1.9.4-1.el7 |
| Red Hat Enterprise Linux 7 | golang-src | 0:1.9.4-1.el7 |
| Red Hat Enterprise Linux 7 | golang-tests | 0:1.9.4-1.el7 |
| SUSE Package Hub 12 | go | 1.9.4-15.1 |
| SUSE Package Hub 12 | go1.8 | 1.8.7-5.1 |
| SUSE Package Hub 12 | go1.9 | 1.9.4-5.1 |
| Ubuntu 16.04 LTS | golang-1.6 | no fix |
| Ubuntu 18.04 LTS | golang-1.8 | no fix |
| openSUSE Tumbleweed | go | 1.17-1.1 |
| openSUSE Tumbleweed | go1.10 | 1.10.8-8.2 |
| openSUSE Tumbleweed | go1.11 | 1.11.13-10.5 |
| openSUSE Tumbleweed | go1.12 | 1.12.17-4.8 |
| openSUSE Tumbleweed | go1.9 | 1.9.7-11.2 |