[SECURITY] [DLA 1294-1] golang security update

2018-02-2515:59:05

lists.debian.org

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.307

Percentile

97.0%

JSON

Package : golang
Version : 2:1.0.2-1.1+deb7u3
CVE ID : CVE-2018-7187

It was discovered that there was an arbitrary command execution
vulnerability in the Go programming language.

The "go get" implementation did not correctly validate "import path"
statements for "://" which allowed remote attackers to execute arbitrary
OS commands via a crafted web site.

For Debian 7 "Wheezy", this issue has been fixed in golang version
2:1.0.2-1.1+deb7u3.

We recommend that you upgrade your golang packages. The Debian LTS team
would like to thank Abhijith PA for preparing this update.

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian7allgolang-mode< 2:1.0.2-1.1+deb7u3golang-mode_2:1.0.2-1.1+deb7u3_all.deb
Debian9armhfgolang-1.8-go< 1.8.1-1+deb9u1golang-1.8-go_1.8.1-1+deb9u1_armhf.deb
Debian7i386golang-src< 2:1.0.2-1.1+deb7u3golang-src_2:1.0.2-1.1+deb7u3_i386.deb
Debian7armhfgolang-go< 2:1.0.2-1.1+deb7u3golang-go_2:1.0.2-1.1+deb7u3_armhf.deb
Debian7allgolang-doc< 2:1.0.2-1.1+deb7u3golang-doc_2:1.0.2-1.1+deb7u3_all.deb
Debian7allgolang< 2:1.0.2-1.1+deb7u3golang_2:1.0.2-1.1+deb7u3_all.deb
Debian7amd64golang-go< 2:1.0.2-1.1+deb7u3golang-go_2:1.0.2-1.1+deb7u3_amd64.deb
Debian9allgolang-1.7< 1.7.4-2+deb9u1golang-1.7_1.7.4-2+deb9u1_all.deb
Debian9i386golang-1.8-go< 1.8.1-1+deb9u1golang-1.8-go_1.8.1-1+deb9u1_i386.deb
Debian9arm64golang-1.8-go< 1.8.1-1+deb9u1golang-1.8-go_1.8.1-1+deb9u1_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	all	golang-mode	< 2:1.0.2-1.1+deb7u3	golang-mode_2:1.0.2-1.1+deb7u3_all.deb
Debian	9	armhf	golang-1.8-go	< 1.8.1-1+deb9u1	golang-1.8-go_1.8.1-1+deb9u1_armhf.deb
Debian	7	i386	golang-src	< 2:1.0.2-1.1+deb7u3	golang-src_2:1.0.2-1.1+deb7u3_i386.deb
Debian	7	armhf	golang-go	< 2:1.0.2-1.1+deb7u3	golang-go_2:1.0.2-1.1+deb7u3_armhf.deb
Debian	7	all	golang-doc	< 2:1.0.2-1.1+deb7u3	golang-doc_2:1.0.2-1.1+deb7u3_all.deb
Debian	7	all	golang	< 2:1.0.2-1.1+deb7u3	golang_2:1.0.2-1.1+deb7u3_all.deb
Debian	7	amd64	golang-go	< 2:1.0.2-1.1+deb7u3	golang-go_2:1.0.2-1.1+deb7u3_amd64.deb
Debian	9	all	golang-1.7	< 1.7.4-2+deb9u1	golang-1.7_1.7.4-2+deb9u1_all.deb
Debian	9	i386	golang-1.8-go	< 1.8.1-1+deb9u1	golang-1.8-go_1.8.1-1+deb9u1_i386.deb
Debian	9	arm64	golang-1.8-go	< 1.8.1-1+deb9u1	golang-1.8-go_1.8.1-1+deb9u1_arm64.deb