CVE-2018-6574

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Link	Resource
https://github.com/golang/go/issues/23672	Issue Tracking Third Party Advisory
https://github.com/KINGSABRI/CVE-in-Ruby/tree/master/CVE-2018-6574	Exploit Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0878	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1304	Third Party Advisory
https://groups.google.com/forum/#!topic/golang-nuts/sprOaQ5m3Dk	Mailing List Third Party Advisory
https://groups.google.com/forum/#!topic/golang-nuts/Gbhh1NxAjMU	Mailing List Third Party Advisory
https://www.debian.org/security/2019/dsa-4380	Third Party Advisory

Configuration 1

cpe:2.3:a:golang:go:1.9:*:*:*:*:*:*:* cpe:2.3:a:golang:go:1.10:rc1:*:*:*:*:*:* cpe:2.3:a:golang:go:1.10:beta2:*:*:*:*:*:* cpe:2.3:a:golang:go:1.10:beta1:*:*:*:*:*:* cpe:2.3:a:golang:go:1.9.1:*:*:*:*:*:*:* cpe:2.3:a:golang:go:1.9.2:*:*:*:*:*:*:* cpe:2.3:a:golang:go:1.9.3:*:*:*:*:*:*:* cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

---

Published : 2018-02-07 09:29

Updated : 2019-10-03 12:03

---

NVD link : CVE-2018-6574

Mitre link : CVE-2018-6574

No products.

CWE-94