CVE-2018-6574
Summary
| CVE | CVE-2018-6574 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2018-02-07 21:29:00 UTC |
|---|
| Updated | 2023-11-07 03:00:00 UTC |
|---|
| Description | Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Google Groups |
CONFIRM |
groups.google.com |
Mailing List, Third Party Advisory |
| Debian -- Security Information -- DSA-4380-1 golang-1.8 |
DEBIAN |
www.debian.org |
Third Party Advisory |
| Red Hat Customer Portal |
REDHAT |
access.redhat.com |
Third Party Advisory |
| Google Groups |
|
groups.google.com |
|
| Red Hat Customer Portal |
REDHAT |
access.redhat.com |
Third Party Advisory |
| CVE-in-Ruby/CVE-2018-6574 at master · KINGSABRI/CVE-in-Ruby · GitHub |
MISC |
github.com |
Exploit, Third Party Advisory |
| Google Groups |
|
groups.google.com |
|
| cmd/go: arbitrary code execution during “go get” · Issue #23672 · golang/go · GitHub |
CONFIRM |
github.com |
Issue Tracking, Third Party Advisory |
| Google Groups |
CONFIRM |
groups.google.com |
Mailing List, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 500979 Alpine Linux Security Update for go
- 710276 Gentoo Linux Go User-assisted execution of arbitrary code Vulnerability (GLSA 201803-03)
