CVE-2018-6574
golang-1.8 - security update
Description
The "go get" command with cgo is vulnerable to remote command execution by leveraging the gcc or clang plugin feature. When cgo is enabled, the build step during "go get" invokes the host C compiler, gcc or clang, adding compiler flags specified in the Go source files. Both gcc and clang support a plugin mechanism in which a shared-library plugin is loaded into the compiler, as directed by compiler flags. This means that a Go package repository can contain an attack.so file along with a Go source file that says (for example) "// #cgo CFLAGS: -fplugin=attack.so" causing the attack plugin to be loaded into the host C compiler during the build. Gcc and clang plugins are completely unrestricted in their access to the host system.
How to fix CVE-2018-6574
To remediate CVE-2018-6574, upgrade the affected package to a fixed version below.
- —upgrade to 1.8.1-1+deb9u1 or later
- —upgrade to 1.8.7 or later
Is CVE-2018-6574 being exploited?
Moderate — EPSS is 36.8%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (2)
- from 0, < 1.8.1-1+deb9u1
- from 0, < 1.8.7, >= 1.9.0-0, < 1.9.4