Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 1657563 (CVE-2018-16873)

Summary: CVE-2018-16873 golang: "go get" command vulnerable to RCE via import of malicious package
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abhgupta, admiller, ahardin, amurdaca, bleanhar, bmontgom, ccoleman, dbaker, dedgar, deparker, dominik.mierzejewski, eparis, jburrell, jcajka, jgoulding, jjoyce, jokerman, jschluet, lemenkov, lhh, lpeer, mburns, mchappel, mmccomas, nstielau, renich, sclewis, security-response-team, sfowler, sisharma, slinaber, sponnaga, sthangav, trankin, wzheng
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: golang 1.10.6, golang 1.11.3 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-27 03:20:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1659288, 1659392, 1659393, 1659913, 1660654, 1660655, 1663381, 1663386, 1664332, 1732081, 1732082, 1732083, 1732084    
Bug Blocks:    

Description Sam Fowler 2018-12-10 00:58:31 UTC
Go before versions 1.10.6 and 1.11.3 is vulnerable to remote code execution.

Comment 2 Sam Fowler 2018-12-11 00:45:01 UTC
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it’s possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with  "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".

Comment 4 Sam Fowler 2018-12-14 01:56:29 UTC
Acknowledgments:

Name: Dmitri Shuralyov (the Go team)

Comment 5 Sam Fowler 2018-12-14 01:56:46 UTC
Created golang tracking bugs for this issue:

Affects: fedora-all [bug 1659288]

Comment 15 Sam Fowler 2019-01-04 06:48:01 UTC
Created golang:1.1/golang tracking bugs for this issue:

Affects: fedora-29 [bug 1663381]

Comment 18 Tomas Hoger 2019-01-08 13:38:25 UTC
Created golang tracking bugs for this issue:

Affects: epel-all [bug 1664332]

Comment 20 Huzaifa S. Sidhpurwala 2019-04-23 09:49:54 UTC
Statement:

This issue affects the version of golang package in Red Hat Enterprise Linux 7. The golang package, previously available in the Optional channel, will no longer receive updates in Red Hat Enterprise Linux 7. Developers are encouraged to use the Go Toolset instead, which is available through the Red Hat Developer program. https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/chap-red_hat_enterprise_linux-7.6_release_notes-deprecated_functionality_in_rhel7#idm139716309923696