CVE-2018-6574: Code Injection
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.8.7 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.9.4 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.10
Event History
Frequently Asked Questions
What is the severity of CVE-2018-6574?
CVE-2018-6574 is classified as a high severity vulnerability due to its potential for remote command execution.
How do I fix CVE-2018-6574?
To mitigate CVE-2018-6574, upgrade to Go version 1.8.7, 1.9.4, or any version above 1.10.
What impacts does CVE-2018-6574 have on affected systems?
CVE-2018-6574 allows attackers to execute arbitrary commands during the source code build process, compromising the security of affected systems.
Which versions of Go are affected by CVE-2018-6574?
CVE-2018-6574 affects Go versions prior to 1.8.7, 1.9.x before 1.9.4, and pre-release versions of Go 1.10.
Is CVE-2018-6574 present in Debian packages?
Yes, CVE-2018-6574 affects Debian packages for Go that are below the fixed version thresholds.