CVE-2018-16874
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.8epss 5.0%
exploitation probability
5.0%top 9% of all CVEs
observed exploitation
nono source reports it
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected products
[UNKNOWN] · golangReferences
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16874https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0https://lists.debian.org/debian-lts-announce/2021/03/msg00014.htmlhttps://lists.debian.org/debian-lts-announce/2021/03/msg00015.htmlhttps://security.gentoo.org/glsa/201812-09http://www.securityfocus.com/bid/106228