An arbitrary command execution flaw was found in the way Go's "go get" command handled gcc and clang sensitive options during the build. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side.
Find out more about CVE-2018-6574 from the MITRE CVE dictionary dictionary and NIST NVD.
This issue affects the versions of golang as shipped with Red Hat OpenShift Enterprise 3. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
| CVSS3 Base Score | 5.8 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L |
| Attack Vector | Network |
| Attack Complexity | High |
| Privileges Required | None |
| User Interaction | Required |
| Scope | Changed |
| Confidentiality | Low |
| Integrity Impact | Low |
| Availability Impact | Low |
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) (go-toolset-7) | RHSA-2018:1304 | 2018-05-03 |
| Red Hat Enterprise Linux 7 (golang) | RHSA-2018:0878 | 2018-04-10 |
| Platform | Package | State |
|---|---|---|
| Red Hat OpenStack Platform Operational Tools 9 | golang | Will not fix |
| Red Hat OpenShift Enterprise 3 | golang | Will not fix |
| Red Hat Gluster Storage 3 | golang | Not affected |
| Red Hat Enterprise Linux OpenStack Platform 8.0 Operational Tools for RHEL 7 | golang | Will not fix |
| Red Hat Ceph Storage 3 | golang | Not affected |
| Red Hat Ceph Storage 2 | golang | Not affected |
Vulmon