Strix
26.1K

CVE-2018-16874

HIGHCVSS 8.1/10EPSS 5.04%

Last modified

CVE-2018-16874 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). EPSS estimates a 5.04% chance of exploitation in the next 30 days.

Description

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

Metrics

CVSS 3.1
8.1/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
5.04%

91.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
GolangGo< 1.10.6
GolangGo>= 1.11.0, < 1.11.3
OpensuseBackports Sle15.0
OpensuseLeap15.0
OpensuseLeap15.1
OpensuseLeap42.3
SuseLinux Enterprise Server12
DebianDebian Linux9.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2018-16874?
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
How severe is CVE-2018-16874?
CVE-2018-16874 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 5.04% probability of exploitation in the next 30 days.
How do I fix CVE-2018-16874?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-16874?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST