CVE-2018-16874

2018-12-1414:00:00

CWE-20

redhat

www.cve.org

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

8.3 High

AI Score

Confidence

High

0.019 Low

EPSS

Percentile

88.7%

JSON

In Go before 1.10.6 and 1.11.x before 1.11.3, the “go get” command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both ‘{’ and ‘}’ characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

CNA Affected

[
  {
    "product": "golang",
    "vendor": "[UNKNOWN]",
    "versions": [
      {
        "status": "affected",
        "version": "1.10.6"
      },
      {
        "status": "affected",
        "version": "1.11.3"
      }
    ]
  }
]