Bug 1657563 (CVE-2018-16873) - CVE-2018-16873 golang: "go get" command vulnerable to RCE via import of malicious package
Summary: CVE-2018-16873 golang: "go get" command vulnerable to RCE via import of malic...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-16873
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1659288 1659392 1659393 1659913 1660654 1660655 1663381 1663386 1664332 1732081 1732082 1732083 1732084
Blocks: 1657559
TreeView+ depends on / blocked
 
Reported: 2018-12-10 00:58 UTC by Sam Fowler
Modified: 2022-03-13 16:25 UTC (History)
35 users (show)

Fixed In Version: golang 1.10.6, golang 1.11.3
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-27 03:20:44 UTC
Embargoed:

Attachments (Terms of Use)

Description Sam Fowler 2018-12-10 00:58:31 UTC 
Go before versions 1.10.6 and 1.11.3 is vulnerable to remote code execution.
Comment 1 Sam Fowler 2018-12-10 01:04:13 UTC 
Pre-announcement:

https://groups.google.com/forum/#!msg/golang-announce/D4sE5tGvhe8/2_RCSJ3yBQAJ
Comment 2 Sam Fowler 2018-12-11 00:45:01 UTC 
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it’s possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with  "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".
Comment 3 Sam Fowler 2018-12-14 01:56:26 UTC 
External Reference:

https://groups.google.com/forum/?pli=1#!topic/golang-announce/Kw31K8G7Fi0


Upstream Issue:

https://github.com/golang/go/issues/29230
Comment 4 Sam Fowler 2018-12-14 01:56:29 UTC 
Acknowledgments:

Name: Dmitri Shuralyov (the Go team)
Comment 5 Sam Fowler 2018-12-14 01:56:46 UTC 
Created golang tracking bugs for this issue:

Affects: fedora-all [bug 1659288]
Comment 15 Sam Fowler 2019-01-04 06:48:01 UTC 
Created golang:1.1/golang tracking bugs for this issue:

Affects: fedora-29 [bug 1663381]
Comment 18 Tomas Hoger 2019-01-08 13:38:25 UTC 
Created golang tracking bugs for this issue:

Affects: epel-all [bug 1664332]
Comment 20 Huzaifa S. Sidhpurwala 2019-04-23 09:49:54 UTC 
Statement:

This issue affects the version of golang package in Red Hat Enterprise Linux 7. The golang package, previously available in the Optional channel, will no longer receive updates in Red Hat Enterprise Linux 7. Developers are encouraged to use the Go Toolset instead, which is available through the Red Hat Developer program. https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/chap-red_hat_enterprise_linux-7.6_release_notes-deprecated_functionality_in_rhel7#idm139716309923696
Note You need to log in before you can comment on or make changes to this bug.