CVE-2018-16874

2018-12-1414:00:00

CWE-20

redhat

www.cve.org

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

AI Score

8.3

Confidence

High

EPSS

0.015

Percentile

87.1%

JSON

In Go before 1.10.6 and 1.11.x before 1.11.3, the “go get” command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both ‘{’ and ‘}’ characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

CNA Affected

[
  {
    "product": "golang",
    "vendor": "[UNKNOWN]",
    "versions": [
      {
        "status": "affected",
        "version": "1.10.6"
      },
      {
        "status": "affected",
        "version": "1.11.3"
      }
    ]
  }
]