vulnerability
SUSE: CVE-2018-16874: SUSE Linux Security Advisory
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:M/Au:N/C:P/I:P/A:P) | Dec 14, 2018 | Dec 20, 2018 | Feb 4, 2022 |
Severity
7
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
Published
Dec 14, 2018
Added
Dec 20, 2018
Modified
Feb 4, 2022
Description
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
Solutions
suse-upgrade-containerdsuse-upgrade-containerd-ctrsuse-upgrade-containerd-kubicsuse-upgrade-containerd-kubic-ctrsuse-upgrade-containerd-kubic-testsuse-upgrade-containerd-testsuse-upgrade-cri-osuse-upgrade-cri-o-kubeadm-criconfigsuse-upgrade-cri-toolssuse-upgrade-dockersuse-upgrade-docker-bash-completionsuse-upgrade-docker-fish-completionsuse-upgrade-docker-kubicsuse-upgrade-docker-kubic-bash-completionsuse-upgrade-docker-kubic-testsuse-upgrade-docker-kubic-zsh-completionsuse-upgrade-docker-libnetworksuse-upgrade-docker-libnetwork-kubicsuse-upgrade-docker-runcsuse-upgrade-docker-runc-kubicsuse-upgrade-docker-runc-kubic-testsuse-upgrade-docker-runc-testsuse-upgrade-docker-testsuse-upgrade-docker-zsh-completionsuse-upgrade-gosuse-upgrade-go-docsuse-upgrade-go-racesuse-upgrade-go1-10suse-upgrade-go1-10-docsuse-upgrade-go1-10-racesuse-upgrade-go1-11suse-upgrade-go1-11-docsuse-upgrade-go1-11-racesuse-upgrade-go1-12suse-upgrade-go1-12-docsuse-upgrade-go1-12-racesuse-upgrade-go1-14suse-upgrade-go1-14-docsuse-upgrade-go1-14-racesuse-upgrade-golang-github-docker-libnetworksuse-upgrade-golang-github-docker-libnetwork-kubicsuse-upgrade-golang-packagingsuse-upgrade-helmsuse-upgrade-helm-mirrorsuse-upgrade-kubernetes-apiserversuse-upgrade-kubernetes-clientsuse-upgrade-kubernetes-controller-managersuse-upgrade-kubernetes-kubeadmsuse-upgrade-kubernetes-kubelet-commonsuse-upgrade-kubernetes-kubelet1-17suse-upgrade-kubernetes-kubelet1-18suse-upgrade-kubernetes-mastersuse-upgrade-kubernetes-nodesuse-upgrade-kubernetes-proxysuse-upgrade-kubernetes-schedulersuse-upgrade-runcsuse-upgrade-runc-test
References
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.