Veracode Vulnerability DatabaseVERACODE:5799Arbitrary Code Execution
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
github.com/golang/go is vulnerable to arbitrary code execution attacks. The application does not filter the compiler flag variables -fplugin= and -plugin= when the go get command is run, allowing a malicious user to inject and execute arbitrary code by loading compiler plugins.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/golang/go | eq | HEAD | |
| github.com/golang/go | le | 1.8.6 | |
| github.com/golang/go | le | 1.10rc1 | |
| github.com/golang/go | le | 1.9.3 |
References
access.redhat.com/errata/RHSA-2018:0878
access.redhat.com/errata/RHSA-2018:1304
github.com/golang/go/issues/23672
github.com/KINGSABRI/CVE-in-Ruby/tree/master/CVE-2018-6574
groups.google.com/forum/#!topic/golang-nuts/Gbhh1NxAjMU
groups.google.com/forum/#!topic/golang-nuts/sprOaQ5m3Dk
www.debian.org/security/2019/dsa-4380
Related
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P