Bug 1546386 (CVE-2018-7187)

Summary:	CVE-2018-7187 golang: arbitrary command execution via VCS path
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	admiller, ahardin, amurdaca, apevec, bleanhar, ccoleman, chrisw, dedgar, deparker, dmcphers, jcajka, jgoulding, jjoyce, jokerman, jschluet, lemenkov, lhh, lpeer, markmc, mburns, mchappel, mnewsome, rbryant, renich, sclewis, sisharma, slinaber, tdecacqu
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	golang 1.9.5, golang 1.10.1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 19:55:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1546387, 1546388, 1565588, 1566229, 1567013, 1567014, 1611188
Bug Blocks:	1546392

Description Laura Pardo 2018-02-16 22:42:02 UTC

A flaw was found in Go Lang. The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.


External References:
https://github.com/golang/go/issues/23867

Upstream Patch:
https://github.com/golang/go/commit/c941e27e70c3e06e1011d2dd71d72a7a06a9bcbc

Comment 1 Laura Pardo 2018-02-16 22:43:26 UTC

Created golang tracking bugs for this issue:

Affects: epel-6 [bug 1546387]
Affects: fedora-all [bug 1546388]

Comment 2 Joshua Padman 2018-02-19 00:53:33 UTC

golang was included in Red Hat OpenStack 8 & 9 operational tools only as a technical preview for customers, it was provided without support and is not intended to be deployed in production.