Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at
Bug 1657563 (CVE-2018-16873) - CVE-2018-16873 golang: "go get" command vulnerable to RCE via import of malicious package
Summary: CVE-2018-16873 golang: "go get" command vulnerable to RCE via import of malic...
Alias: CVE-2018-16873
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1659288 1659392 1659393 1659913 1660654 1660655 1663381 1663386 1664332 1732081 1732082 1732083 1732084
TreeView+ depends on / blocked
Reported: 2018-12-10 00:58 UTC by Sam Fowler
Modified: 2022-03-13 16:25 UTC (History)
35 users (show)

Fixed In Version: golang 1.10.6, golang 1.11.3
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2021-10-27 03:20:44 UTC

Attachments (Terms of Use)

Description Sam Fowler 2018-12-10 00:58:31 UTC
Go before versions 1.10.6 and 1.11.3 is vulnerable to remote code execution.

Comment 2 Sam Fowler 2018-12-11 00:45:01 UTC
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at Using custom domains, it’s possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with  "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".

Comment 4 Sam Fowler 2018-12-14 01:56:29 UTC

Name: Dmitri Shuralyov (the Go team)

Comment 5 Sam Fowler 2018-12-14 01:56:46 UTC
Created golang tracking bugs for this issue:

Affects: fedora-all [bug 1659288]

Comment 15 Sam Fowler 2019-01-04 06:48:01 UTC
Created golang:1.1/golang tracking bugs for this issue:

Affects: fedora-29 [bug 1663381]

Comment 18 Tomas Hoger 2019-01-08 13:38:25 UTC
Created golang tracking bugs for this issue:

Affects: epel-all [bug 1664332]

Comment 20 Huzaifa S. Sidhpurwala 2019-04-23 09:49:54 UTC

This issue affects the version of golang package in Red Hat Enterprise Linux 7. The golang package, previously available in the Optional channel, will no longer receive updates in Red Hat Enterprise Linux 7. Developers are encouraged to use the Go Toolset instead, which is available through the Red Hat Developer program.

Note You need to log in before you can comment on or make changes to this bug.