CVE-2018-6574
published 2018-02-07CVE-2018-6574: Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by…
PriorityP347high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EPSS
7.63%
93.9th percentile
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| golang | go | <= 1.8.6 | — |
| golang | go | — | — |
| golang | go | — | — |
| golang | go | — | — |
| golang | go | — | — |
| golang | go | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Remote command execution via "go get" command with cgo in cmd/go
osv·2022-08-09
CVE-2018-6574 Remote command execution via "go get" command with cgo in cmd/go
Remote command execution via "go get" command with cgo in cmd/go
The "go get" command with cgo is vulnerable to remote command execution by leveraging the gcc or clang plugin feature.
When cgo is enabled, the build step during "go get" invokes the host C compiler, gcc or clang, adding compiler flags specified in the Go source files. Both gcc and clang support a plugin mechanism in which a shared-library plugin is loaded into the compiler, as directed by compiler flags. This means that a Go package repository can contain an attack.so file along with a Go source file that says (for example) "// #cgo CFLAGS: -fplugin=attack.so" causing the attack plugin to be loaded into the host C compiler during the build. Gcc and clang plugins are completely unrestricted in their access to the host syste
GHSA
GHSA-c37c-qq99-c897: Go before 1
ghsa_unreviewed·2022-05-13
CVE-2018-6574 [HIGH] CWE-94 GHSA-c37c-qq99-c897: Go before 1
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.
OSV
CVE-2018-6574: Go before 1
osv·2018-02-07·CVSS 7.8
CVE-2018-6574 [HIGH] CVE-2018-6574: Go before 1
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.
Red Hat
golang: arbitrary code execution during "go get" via C compiler options
vendor_redhat·2018-02-07·CVSS 7.8
CVE-2018-6574 [HIGH] CWE-20 golang: arbitrary code execution during "go get" via C compiler options
golang: arbitrary code execution during "go get" via C compiler options
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.
An arbitrary command execution flaw was found in the way Go's "go get" command handled gcc and clang sensitive options during the build. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side.
Statement: This issue affects the versions of golang as shipped with Red Hat OpenShift Enterprise 3. Red Hat Product Security has rated this issue as having security impact of Moderate
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-6574 golang: arbitrary code execution during "go get" via C compiler options [fedora-all]
bugzilla·2018-02-08·CVSS 7.8
CVE-2018-6574 [HIGH] CVE-2018-6574 golang: arbitrary code execution during "go get" via C compiler options [fedora-all]
CVE-2018-6574 golang: arbitrary code execution during "go get" via C compiler options [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multip
Bugzilla
CVE-2018-6574 golang: arbitrary code execution during "go get" via C compiler options [epel-6]
bugzilla·2018-02-08·CVSS 7.8
CVE-2018-6574 [HIGH] CVE-2018-6574 golang: arbitrary code execution during "go get" via C compiler options [epel-6]
CVE-2018-6574 golang: arbitrary code execution during "go get" via C compiler options [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-6.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following template
Bugzilla
CVE-2018-6574 golang: arbitrary code execution during "go get" via C compiler options
bugzilla·2018-02-08·CVSS 7.8
CVE-2018-6574 [HIGH] CVE-2018-6574 golang: arbitrary code execution during "go get" via C compiler options
CVE-2018-6574 golang: arbitrary code execution during "go get" via C compiler options
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.
Upstream issue:
https://github.com/golang/go/issues/23672
Upstream patch:
https://go.googlesource.com/go/+/44821583bc16ff2508664fab94360bb856e9e9d6
https://go.googlesource.com/go/+/867fb18b6d5bc73266b68c9a695558a04e060a8a
Discussion:
Created golang tracking bugs for this issue:
Affects: epel-6 [bug 1543563]
Affects: fedora-all [bug 1543562]
---
golang was included in Red Hat OpenStack 8 & 9 operational tools only as a technical preview for custo
https://access.redhat.com/errata/RHSA-2018:0878https://access.redhat.com/errata/RHSA-2018:1304https://github.com/KINGSABRI/CVE-in-Ruby/tree/master/CVE-2018-6574https://github.com/golang/go/issues/23672https://groups.google.com/forum/#%21topic/golang-nuts/Gbhh1NxAjMUhttps://groups.google.com/forum/#%21topic/golang-nuts/sprOaQ5m3Dkhttps://www.debian.org/security/2019/dsa-4380https://access.redhat.com/errata/RHSA-2018:0878https://access.redhat.com/errata/RHSA-2018:1304https://github.com/KINGSABRI/CVE-in-Ruby/tree/master/CVE-2018-6574https://github.com/golang/go/issues/23672https://groups.google.com/forum/#%21topic/golang-nuts/Gbhh1NxAjMUhttps://groups.google.com/forum/#%21topic/golang-nuts/sprOaQ5m3Dkhttps://www.debian.org/security/2019/dsa-4380
2018-02-07
Published