CVE-2018-16873: Input Validation
First published: Fri Dec 14 2018(Updated: )
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Golang Go | <1.10.6 | |
| Golang Go | >=1.11.0<1.11.3 | |
| openSUSE Backports SLE | =15.0 | |
| openSUSE Leap | =15.0 | |
| openSUSE Leap | =15.1 | |
| openSUSE Leap | =42.3 | |
| SUSE Linux Enterprise Server | =12 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
- http://www.securityfocus.com/bid/106226
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16873
- https://groups.google.com/forum/?pli=1#!topic/golang-announce/Kw31K8G7Fi0
- https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html
- https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html
- https://security.gentoo.org/glsa/201812-09
Frequently Asked Questions
What is CVE-2018-16873?
CVE-2018-16873 is a vulnerability in Go before 1.10.6 and 1.11.x before 1.11.3 that allows remote code execution.
How severe is CVE-2018-16873?
CVE-2018-16873 has a severity rating of 8.1 (high).
Which software versions are affected by CVE-2018-16873?
CVE-2018-16873 affects Go versions before 1.10.6 and 1.11.x before 1.11.3.
How can I fix CVE-2018-16873?
To fix CVE-2018-16873, update Go to version 1.10.6 or upgrade to Go version 1.11.3 or later.
Are there any references for CVE-2018-16873?
Yes, you can find references for CVE-2018-16873 at the following links: [link1](http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html), [link2](http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html), [link3](http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html).
- agent/severity
- agent/references
- agent/author
- agent/weakness
- agent/tags
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/golang
- canonical/golang go
- version/golang go/1.11.0
- vendor/opensuse
- canonical/opensuse backports sle
- version/opensuse backports sle/15.0
- canonical/opensuse leap
- version/opensuse leap/15.0
- version/opensuse leap/15.1
- version/opensuse leap/42.3
- vendor/suse
- canonical/suse linux enterprise server
- version/suse linux enterprise server/12
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0