Bug 1657563 (CVE-2018-16873)

Summary: CVE-2018-16873 golang: "go get" command vulnerable to RCE via import of malicious package
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abhgupta, admiller, ahardin, amurdaca, bleanhar, bmontgom, ccoleman, dbaker, dbecker, dedgar, deparker, dominik.mierzejewski, eparis, jburrell, jcajka, jgoulding, jjoyce, jokerman, jschluet, lemenkov, lhh, lpeer, mburns, mchappel, mmccomas, nstielau, renich, sclewis, security-response-team, sfowler, sisharma, slinaber, sponnaga, sthangav, trankin, wzheng
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: golang 1.10.6, golang 1.11.3 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1659288, 1659392, 1659393, 1659913, 1660654, 1660655, 1663381, 1663386, 1664332, 1732081, 1732082, 1732083, 1732084    
Bug Blocks: 1657559    

Description Sam Fowler 2018-12-10 00:58:31 UTC
Go before versions 1.10.6 and 1.11.3 is vulnerable to remote code execution.

Comment 2 Sam Fowler 2018-12-11 00:45:01 UTC
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it’s possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with  "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".

Comment 4 Sam Fowler 2018-12-14 01:56:29 UTC
Acknowledgments:

Name: Dmitri Shuralyov (the Go team)

Comment 5 Sam Fowler 2018-12-14 01:56:46 UTC
Created golang tracking bugs for this issue:

Affects: fedora-all [bug 1659288]

Comment 15 Sam Fowler 2019-01-04 06:48:01 UTC
Created golang:1.1/golang tracking bugs for this issue:

Affects: fedora-29 [bug 1663381]

Comment 18 Tomas Hoger 2019-01-08 13:38:25 UTC
Created golang tracking bugs for this issue:

Affects: epel-all [bug 1664332]

Comment 20 Huzaifa S. Sidhpurwala 2019-04-23 09:49:54 UTC
Statement:

This issue affects the version of golang package in Red Hat Enterprise Linux 7. The golang package, previously available in the Optional channel, will no longer receive updates in Red Hat Enterprise Linux 7. Developers are encouraged to use the Go Toolset instead, which is available through the Red Hat Developer program. https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/chap-red_hat_enterprise_linux-7.6_release_notes-deprecated_functionality_in_rhel7#idm139716309923696