Bug 1657563 (CVE-2018-16873) - CVE-2018-16873 golang: "go get" command vulnerable to RCE via import of malicious package
Summary: CVE-2018-16873 golang: "go get" command vulnerable to RCE via import of malic...
Status: NEW
Alias: CVE-2018-16873
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20181213:2000,...
Keywords: Security
Depends On: 1659392 1659393 1659913 1663381 1663386 1659288 1660654 1660655 1664332
Blocks: 1657559
TreeView+ depends on / blocked
 
Reported: 2018-12-10 00:58 UTC by Sam Fowler
Modified: 2019-04-23 09:49 UTC (History)
36 users (show)

Fixed In Version: golang 1.10.6, golang 1.11.3
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Sam Fowler 2018-12-10 00:58:31 UTC
Go before versions 1.10.6 and 1.11.3 is vulnerable to remote code execution.

Comment 2 Sam Fowler 2018-12-11 00:45:01 UTC
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it’s possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with  "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".

Comment 4 Sam Fowler 2018-12-14 01:56:29 UTC
Acknowledgments:

Name: Dmitri Shuralyov (the Go team)

Comment 5 Sam Fowler 2018-12-14 01:56:46 UTC
Created golang tracking bugs for this issue:

Affects: fedora-all [bug 1659288]

Comment 15 Sam Fowler 2019-01-04 06:48:01 UTC
Created golang:1.1/golang tracking bugs for this issue:

Affects: fedora-29 [bug 1663381]

Comment 18 Tomas Hoger 2019-01-08 13:38:25 UTC
Created golang tracking bugs for this issue:

Affects: epel-all [bug 1664332]

Comment 20 Huzaifa S. Sidhpurwala 2019-04-23 09:49:54 UTC
Statement:

This issue affects the version of golang package in Red Hat Enterprise Linux 7. The golang package, previously available in the Optional channel, will no longer receive updates in Red Hat Enterprise Linux 7. Developers are encouraged to use the Go Toolset instead, which is available through the Red Hat Developer program. https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/chap-red_hat_enterprise_linux-7.6_release_notes-deprecated_functionality_in_rhel7#idm139716309923696


Note You need to log in before you can comment on or make changes to this bug.