github.com/golang/go is vulnerable to arbitrary code execution attacks. The application does not filter the compiler flag variables -fplugin=
and -plugin=
when the go get
command is run, allowing a malicious user to inject and execute arbitrary code by loading compiler plugins.
access.redhat.com/documentation/en-us/red_hat_developer_tools/2018.2/html/using_go_toolset/
access.redhat.com/errata/RHSA-2018:0878
access.redhat.com/errata/RHSA-2018:1304
access.redhat.com/security/updates/classification/#moderate
access.redhat.com/support/offerings/techpreview/
bugzilla.redhat.com/show_bug.cgi?id=1536154
bugzilla.redhat.com/show_bug.cgi?id=1550079
github.com/golang/go/issues/23672
github.com/KINGSABRI/CVE-in-Ruby/tree/master/CVE-2018-6574
groups.google.com/forum/#!topic/golang-nuts/Gbhh1NxAjMU
groups.google.com/forum/#!topic/golang-nuts/sprOaQ5m3Dk
www.debian.org/security/2019/dsa-4380