CVE-2018-16874
HIGHCVSS 8.1/10EPSS 5.04%
Last modified
CVE-2018-16874 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). EPSS estimates a 5.04% chance of exploitation in the next 30 days.
Description
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Golang | Go | < 1.10.6 |
| Golang | Go | >= 1.11.0, < 1.11.3 |
| Opensuse | Backports Sle | 15.0 |
| Opensuse | Leap | 15.0 |
| Opensuse | Leap | 15.1 |
| Opensuse | Leap | 42.3 |
| Suse | Linux Enterprise Server | 12 |
| Debian | Debian Linux | 9.0 |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.htmlMailing List, Third Party Advisory
- http://www.securityfocus.com/bid/106228Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16874Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00014.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00015.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201812-09Mitigation, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.htmlMailing List, Third Party Advisory
- http://www.securityfocus.com/bid/106228Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16874Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00014.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00015.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201812-09Mitigation, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-16874?
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
How severe is CVE-2018-16874?
CVE-2018-16874 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 5.04% probability of exploitation in the next 30 days.
How do I fix CVE-2018-16874?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-16868A Bleichenbacher type side-channel based padding oracle atta…5.6
- CVE-2018-16869A Bleichenbacher type side-channel based padding oracle atta…5.7
- CVE-2018-16870It was found that wolfssl before 3.15.7 is vulnerable to a n…
- CVE-2018-16871A flaw was found in the Linux kernel's NFS implementation, a…7.5
- CVE-2018-16872A flaw was found in qemu Media Transfer Protocol (MTP). The …5.3
- CVE-2018-16873In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" c…8.1
- CVE-2018-16875The crypto/x509 package of Go before 1.10.6 and 1.11.x befor…5.9
- CVE-2018-16876ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable …5.3
- CVE-2018-16877A flaw was found in the way pacemaker's client-server authen…7.8
- CVE-2018-16878A flaw was found in pacemaker up to and including version 2.…5.5
- CVE-2018-16879Ansible Tower before version 3.3.3 does not set a secure cha…9.8
- CVE-2018-1688IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Ma…5.4
Are you affected by CVE-2018-16874?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST