4.6
CVSSv2

CVE-2018-6574

Published: 07/02/2018 Updated: 03/10/2019
CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 415
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

Go prior to 1.8.7, Go 1.9.x prior to 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Vulnerable Product Search on Vulmon Subscribe to Product

golang go

golang go 1.9

golang go 1.9.1

golang go 1.9.2

golang go 1.9.3

golang go 1.10

debian debian linux 9.0

redhat enterprise linux server 7.0

redhat enterprise linux server aus 7.6

redhat enterprise linux server eus 7.6

redhat enterprise linux server tus 7.6

Vendor Advisories

Synopsis Moderate: go-toolset-7 and go-toolset-7-golang security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for go-toolset-7 and go-toolset-7-golang is now available for Red Hat Developer ToolsRed Hat Product Security has rated this update as having a security impact of Mo ...
Synopsis Moderate: golang security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for golang is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring Syst ...
An arbitrary command execution flaw was found in the way Go's "go get" command handled gcc and clang sensitive options during the build A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side ...
Arch Linux Security Advisory ASA-201802-3 ========================================= Severity: High Date : 2018-02-09 CVE-ID : CVE-2018-6574 Package : go-pie Type : arbitrary code execution Remote : Yes Link : securityarchlinuxorg/AVG-606 Summary ======= The package go-pie before version 194-1 is vulnerable to arbitrary cod ...
Arch Linux Security Advisory ASA-201802-2 ========================================= Severity: High Date : 2018-02-09 CVE-ID : CVE-2018-6574 Package : go Type : arbitrary code execution Remote : Yes Link : securityarchlinuxorg/AVG-606 Summary ======= The package go before version 194-1 is vulnerable to arbitrary code execut ...
Go before 187, Go 19x before 194, and Go 110 pre-releases before Go 110rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked ...
Arbitrary code execution during "go get" via C compiler options:An arbitrary command execution flaw was found in the way Go's "go get" command handled gcc and clang sensitive options during the build A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side ...
Arbitrary code execution during go get or go get -dGo before 184 and 19x before 191 allows "go get" remote command execution Using custom domains, it is possible to arrange things so that examplecom/pkg1 points to a Subversion repository but examplecom/pkg1/pkg2 points to a Git repository If the Subversion repository includes a Git checko ...

Mailing Lists

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4380-1 security () debian org wwwdebianorg/security/ Moritz Muehlenhoff February 01, 2019 wwwdebianorg/security/faq ...

Github Repositories

A simple POC for CVE-2018-6574

CVE-2018-6574 POC LINK A simple POC for CVE-2018-6574 nvdnistgov/vuln/detail/CVE-2018-6574 blognsfocusnet/cve-2018-6574/

CVE-2018-6574 POC 相关链接 nvdnistgov/vuln/detail/CVE-2018-6574 blognsfocusnet/cve-2018-6574/ githubcom/neargle/CVE-2018-6574-POC 运行 go get githubcom/hitwhfanke/CNNVD-201802-203 使用说明 payload 在: githubcom/hitwhfanke/CNNVD-201802-203/blob/master/calcc#L10 现在已经用 CGO 的特性支持了全平台,linux go get 之

CVE-2018-6574 POC : golang 'go get' remote command execution during source code build

CVE-2018-6574 POC LINK nvdnistgov/vuln/detail/CVE-2018-6574 blognsfocusnet/cve-2018-6574/ RUN go get githubcom/neargle/CVE-2018-6574-POC DETAIL payload 在: githubcom/neargle/CVE-2018-6574-POC/blob/master/calcc#L10 现在已经用 CGO 的特性支持了全平台,linux go get 之后会新建一个 /tmp/go-rce-poc 文件,MAC 和 Windows 还是

Vulnerble-code

CVE-2018-6574 Vulnerble-code PoC para explotar CVE-2018-6574 en Pentesterlab!!

CVE-2018-6574

CVE-2018-6574

CVE-2018-6574

CVE-2018-6574

CVE-2018-6574-Solution

CVE-2018-6574: go get RCE solution for pentesterlab challenge

CVE-2018-6574-Solution gcc -shared -o attackso -fPIC attackc

CVE-2018-6574

go-get-rce CVE-2018-6574

CVE-2018-6574

CVE-2018-6574-Solution

ptlab-cve-2018-6574

CVE-2018-6574

CVE-2018-6574

CVE-2018-6574 CVE-2018-6574

CVE-2018-6574 go get RCE

CVE-2018-6574 CVE-2018-6574 go get RCE

demo CVE-2018-6574 Go Exploit via GithubThis vulnerability impacts Golang go get command and allows an attacker to gain code execution on a system installing his malicious library This is a good example of a vulnerability that can be exploited using typosquatting to gain code execution on developers' workstations and production systems This vulnerability was fixed in

This repository holds a PoC of the CVE-2018-6574 "go get RCE", that allowed to execute commands when downloading a 3rd party package This could be done, as the cflags allowed to set an external library In this PoC, the external library executes a command on the constructor

CVE-2018-6574

go-get-exploit CVE-2018-6574

PoC in GitHub 2020 CVE-2020-0014 It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable This could lead to a local escalation of privilege with no additional execution privileges needed User action is needed for exploitationProduct: AndroidVersions: Android-80 Android-81 Android-9 Android-10Android ID: A-1286745

PoC auto collect from GitHub.

PoC in GitHub 2020 CVE-2020-0022 In reassemble_and_dispatch of packet_fragmentercc, there is possible out of bounds write due to an incorrect bounds calculation This could lead to remote code execution over Bluetooth with no additional execution privileges needed User interaction is not needed for exploitationProduct: AndroidVersions: Android-80 Android-81 Android-9 Andr