{"id":"CVE-2018-16873","aliases":["BELL-CVE-2018-16873","DLA-2591-1","DLA-2592-1","EUVD-2018-8664","GHSA-q6pp-3q54-qw37","GO-2022-0189","MGASA-2019-0066","MGASA-2019-0180","SUSE-SU-2018:4297-1","SUSE-SU-2019:0048-1","SUSE-SU-2019:0048-2","SUSE-SU-2019:0286-1","SUSE-SU-2019:0495-1","SUSE-SU-2019:0573-1","SUSE-SU-2019:1234-1","SUSE-SU-2019:1234-2","SUSE-SU-2019:1264-1","SUSE-SU-2021:1458-1","SUSE-SU-2024:3656-1","SUSE-SU-2025:03540-1","SUSE-SU-2025:03545-1","UBUNTU-CVE-2018-16873","openSUSE-SU-2019:0170-1","openSUSE-SU-2019:0189-1","openSUSE-SU-2019:0208-1","openSUSE-SU-2019:0295-1","openSUSE-SU-2019:1444-1","openSUSE-SU-2019:1499-1","openSUSE-SU-2019:1506-1","openSUSE-SU-2019:1703-1","openSUSE-SU-2020:0554-1","openSUSE-SU-2024:10693-1","openSUSE-SU-2024:10699-1","openSUSE-SU-2024:10722-1","openSUSE-SU-2024:10741-1","openSUSE-SU-2024:10761-1","openSUSE-SU-2024:10802-1","openSUSE-SU-2024:10803-1","openSUSE-SU-2024:10804-1","openSUSE-SU-2024:10805-1","openSUSE-SU-2024:10841-1","openSUSE-SU-2024:10842-1","openSUSE-SU-2024:11358-1","openSUSE-SU-2025:15589-1","openSUSE-SU-2025:15779-1"],"status":"published","title":"In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to remote code...","description":"In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named \".git\" by using a vanity import path that ends with \"/.git\". If the Git repository root contains a \"HEAD\" file, a \"config\" file, an \"objects\" directory, a \"refs\" directory, with some work to ensure the proper ordering of operations, \"go get -u\" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the \"config\" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running \"go get -u\".","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.66252,"percentile":0.99284,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-12-14T14:00:00Z","modified":"2026-10-24T10:30:53Z","fixes":[{"ecosystem":"Go","package":"toolchain","fixed_in":["1.10.6","1.11.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:9","package":"golang-1.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-2+deb9u3"}]}],"versions":["1.7.4-2","1.7.4-2+deb9u1","1.7.4-2+deb9u2"],"bundled":7},{"source":"osv","ecosystem":"Debian:9","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1+deb9u3"}]}],"versions":["1.8.1-1","1.8.1-1+deb9u1","1.8.1-1+deb9u2"],"bundled":7},{"source":"osv","ecosystem":"Go","package":"toolchain","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.10.6"},{"introduced":"1.11.0-0"},{"fixed":"1.11.3"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.5-1.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.06.3-1.2.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-5.3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.06.1_ce-6.8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"helm-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.1-1.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"helm-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.1-1.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-5.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.0_ce-6.11.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc5+gitr3562_69663f0bd4b6-6.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2704_6da50d197830-4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-5.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.1_ce-6.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc6+gitr3748_96ec2177ae84-6.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2711_2cfbf9b1f981-4.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-16.14.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.1_ce-98.34.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6-LTSS","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc6+gitr3748_96ec2177ae84-1.17.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6-LTSS","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2711_2cfbf9b1f981-16.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-16.14.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.1_ce-98.34.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc6+gitr3748_96ec2177ae84-1.17.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2711_2cfbf9b1f981-16.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-5.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.6_ce-6.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc6+gitr3804_2b18fe1d885e-6.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2726_872f0a83c98a-4.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-5.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.6_ce-6.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc6+gitr3804_2b18fe1d885e-6.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2726_872f0a83c98a-4.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-16.17.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.6_ce-98.37.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc6+gitr3804_2b18fe1d885e-1.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2726_872f0a83c98a-19.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-16.38.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-98.66.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-16.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.7.6.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.7.6.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-1.20.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-1.20.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10~rc1-1","1.10~rc1-1ubuntu1","1.10~rc1-2ubuntu1","1.10~rc2-1ubuntu1","1.10-1ubuntu1","1.10.1-1ubuntu2","1.10.4-2ubuntu1~18.04.1","1.10.4-2ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc6-bp150.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-lp151.2.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.6_ce-lp151.2.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc6+gitr3804_2b18fe1d885e-lp151.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-lp151.2.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.9-lp151.2.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.4-lp151.2.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2726_872f0a83c98a-lp151.2.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-lp150.4.14.3"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.6_ce-lp150.5.17.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc6+gitr3804_2b18fe1d885e-lp150.5.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-lp150.2.11.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"go1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.9-lp150.9.3"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.4-lp150.2.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2726_872f0a83c98a-lp150.3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-bp150.2.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 12 SP3","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-lp151.2.2"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-lp151.2.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-lp151.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-lp151.5.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-2.2"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-1.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-2.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.16-3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-1.2"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.13-10.5"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.17-4.8"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.3-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-1.9"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-1.2"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-15.1"}]}],"bundled":43},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.2-1.1"}]}],"bundled":20}],"products":[{"vendor":"[unknown]","product":"golang"},{"vendor":"debian","product":"debian_linux"},{"vendor":"go programming language","product":"golang"},{"vendor":"golang","product":"go"},{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"},{"vendor":"suse","product":"linux_enterprise_server"}],"references":[{"url":"http://www.securityfocus.com/bid/106226","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201812-09","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Mitigation","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16873","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16873"},{"url":"https://groups.google.com/forum/?pli=1#!topic/golang-announce/Kw31K8G7Fi0","tags":["report"]},{"url":"https://github.com/advisories/GHSA-q6pp-3q54-qw37"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-16873","tags":["advisory"]},{"url":"https://go.dev/cl/154101","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/bc82d7c7db83487e05d7a88e06549d4ae2a688c3","tags":["fix"]},{"url":"https://go.dev/issue/29230","tags":["report"]},{"url":"https://groups.google.com/g/golang-announce/c/Kw31K8G7Fi0","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2019-0066.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24014","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-12/msg00094.html","tags":["web"]},{"url":"https://www.debian.org/security/2019/dsa-4380","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2019-0180.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24374","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-02/msg00078.html","tags":["web"]},{"url":"https://github.com/docker/docker-ce/blob/v18.09.3/CHANGELOG.md","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20184297-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1047218","tags":["report"]},{"url":"https://bugzilla.suse.com/1074971","tags":["report"]},{"url":"https://bugzilla.suse.com/1080978","tags":["report"]},{"url":"https://bugzilla.suse.com/1081495","tags":["report"]},{"url":"https://bugzilla.suse.com/1084533","tags":["report"]},{"url":"https://bugzilla.suse.com/1086185","tags":["report"]},{"url":"https://bugzilla.suse.com/1094680","tags":["report"]},{"url":"https://bugzilla.suse.com/1095817","tags":["report"]},{"url":"https://bugzilla.suse.com/1098017","tags":["report"]},{"url":"https://bugzilla.suse.com/1102522","tags":["report"]},{"url":"https://bugzilla.suse.com/1104821","tags":["report"]},{"url":"https://bugzilla.suse.com/1105000","tags":["report"]},{"url":"https://bugzilla.suse.com/1108038","tags":["report"]},{"url":"https://bugzilla.suse.com/1113313","tags":["report"]},{"url":"https://bugzilla.suse.com/1113978","tags":["report"]},{"url":"https://bugzilla.suse.com/1114209","tags":["report"]},{"url":"https://bugzilla.suse.com/1118897","tags":["report"]},{"url":"https://bugzilla.suse.com/1118898","tags":["report"]},{"url":"https://bugzilla.suse.com/1118899","tags":["report"]},{"url":"https://bugzilla.suse.com/1119634","tags":["report"]},{"url":"https://bugzilla.suse.com/1119706","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7187","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190048-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1116182","tags":["report"]},{"url":"https://bugzilla.suse.com/1120762","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190048-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190286-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1001161","tags":["report"]},{"url":"https://bugzilla.suse.com/1112980","tags":["report"]},{"url":"https://bugzilla.suse.com/1115464","tags":["report"]},{"url":"https://bugzilla.suse.com/1118990","tags":["report"]},{"url":"https://bugzilla.suse.com/1121412","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190495-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1048046","tags":["report"]},{"url":"https://bugzilla.suse.com/1051429","tags":["report"]},{"url":"https://bugzilla.suse.com/1114832","tags":["report"]},{"url":"https://bugzilla.suse.com/1121967","tags":["report"]},{"url":"https://bugzilla.suse.com/1124308","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5736","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190573-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9962","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191234-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1121397","tags":["report"]},{"url":"https://bugzilla.suse.com/1123013","tags":["report"]},{"url":"https://bugzilla.suse.com/1128376","tags":["report"]},{"url":"https://bugzilla.suse.com/1128746","tags":["report"]},{"url":"https://bugzilla.suse.com/1134068","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6486","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191234-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191264-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211458-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1028638","tags":["report"]},{"url":"https://bugzilla.suse.com/1034053","tags":["report"]},{"url":"https://bugzilla.suse.com/1053532","tags":["report"]},{"url":"https://bugzilla.suse.com/1131314","tags":["report"]},{"url":"https://bugzilla.suse.com/1131553","tags":["report"]},{"url":"https://bugzilla.suse.com/1149954","tags":["report"]},{"url":"https://bugzilla.suse.com/1152308","tags":["report"]},{"url":"https://bugzilla.suse.com/1160452","tags":["report"]},{"url":"https://bugzilla.suse.com/1168481","tags":["report"]},{"url":"https://bugzilla.suse.com/1175081","tags":["report"]},{"url":"https://bugzilla.suse.com/1175821","tags":["report"]},{"url":"https://bugzilla.suse.com/1181594","tags":["report"]},{"url":"https://bugzilla.suse.com/1181641","tags":["report"]},{"url":"https://bugzilla.suse.com/1181677","tags":["report"]},{"url":"https://bugzilla.suse.com/1181730","tags":["report"]},{"url":"https://bugzilla.suse.com/1181732","tags":["report"]},{"url":"https://bugzilla.suse.com/1181749","tags":["report"]},{"url":"https://bugzilla.suse.com/1182451","tags":["report"]},{"url":"https://bugzilla.suse.com/1182476","tags":["report"]},{"url":"https://bugzilla.suse.com/1182947","tags":["report"]},{"url":"https://bugzilla.suse.com/1183024","tags":["report"]},{"url":"https://bugzilla.suse.com/1183397","tags":["report"]},{"url":"https://bugzilla.suse.com/1183855","tags":["report"]},{"url":"https://bugzilla.suse.com/1184768","tags":["report"]},{"url":"https://bugzilla.suse.com/1184962","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21334","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243656-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1095184","tags":["report"]},{"url":"https://bugzilla.suse.com/1121850","tags":["report"]},{"url":"https://bugzilla.suse.com/1174951","tags":["report"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1183703","tags":["report"]},{"url":"https://bugzilla.suse.com/1199031","tags":["report"]},{"url":"https://bugzilla.suse.com/1208270","tags":["report"]},{"url":"https://bugzilla.suse.com/1208297","tags":["report"]},{"url":"https://bugzilla.suse.com/1210138","tags":["report"]},{"url":"https://bugzilla.suse.com/1213229","tags":["report"]},{"url":"https://bugzilla.suse.com/1217070","tags":["report"]},{"url":"https://bugzilla.suse.com/1217950","tags":["report"]},{"url":"https://bugzilla.suse.com/1218150","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48795","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503540-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1004490","tags":["report"]},{"url":"https://bugzilla.suse.com/1007249","tags":["report"]},{"url":"https://bugzilla.suse.com/1009961","tags":["report"]},{"url":"https://bugzilla.suse.com/1012568","tags":["report"]},{"url":"https://bugzilla.suse.com/1015661","tags":["report"]},{"url":"https://bugzilla.suse.com/1016307","tags":["report"]},{"url":"https://bugzilla.suse.com/1016992","tags":["report"]},{"url":"https://bugzilla.suse.com/1019251","tags":["report"]},{"url":"https://bugzilla.suse.com/1020806","tags":["report"]},{"url":"https://bugzilla.suse.com/1021227","tags":["report"]},{"url":"https://bugzilla.suse.com/1026827","tags":["report"]},{"url":"https://bugzilla.suse.com/1028639","tags":["report"]},{"url":"https://bugzilla.suse.com/1029320","tags":["report"]},{"url":"https://bugzilla.suse.com/1029630","tags":["report"]},{"url":"https://bugzilla.suse.com/1030702","tags":["report"]},{"url":"https://bugzilla.suse.com/1032287","tags":["report"]},{"url":"https://bugzilla.suse.com/1032644","tags":["report"]},{"url":"https://bugzilla.suse.com/1034063","tags":["report"]},{"url":"https://bugzilla.suse.com/1037436","tags":["report"]},{"url":"https://bugzilla.suse.com/1037607","tags":["report"]},{"url":"https://bugzilla.suse.com/1038476","tags":["report"]},{"url":"https://bugzilla.suse.com/1038493","tags":["report"]},{"url":"https://bugzilla.suse.com/1045628","tags":["report"]},{"url":"https://bugzilla.suse.com/1046024","tags":["report"]},{"url":"https://bugzilla.suse.com/1055676","tags":["report"]},{"url":"https://bugzilla.suse.com/1057743","tags":["report"]},{"url":"https://bugzilla.suse.com/1058173","tags":["report"]},{"url":"https://bugzilla.suse.com/1059011","tags":["report"]},{"url":"https://bugzilla.suse.com/1064781","tags":["report"]},{"url":"https://bugzilla.suse.com/1065609","tags":["report"]},{"url":"https://bugzilla.suse.com/1066210","tags":["report"]},{"url":"https://bugzilla.suse.com/1066801","tags":["report"]},{"url":"https://bugzilla.suse.com/1069468","tags":["report"]},{"url":"https://bugzilla.suse.com/1069758","tags":["report"]},{"url":"https://bugzilla.suse.com/1072798","tags":["report"]},{"url":"https://bugzilla.suse.com/1073877","tags":["report"]},{"url":"https://bugzilla.suse.com/1085117","tags":["report"]},{"url":"https://bugzilla.suse.com/1085380","tags":["report"]},{"url":"https://bugzilla.suse.com/1089732","tags":["report"]},{"url":"https://bugzilla.suse.com/1096726","tags":["report"]},{"url":"https://bugzilla.suse.com/1099277","tags":["report"]},{"url":"https://bugzilla.suse.com/1100331","tags":["report"]},{"url":"https://bugzilla.suse.com/1100727","tags":["report"]},{"url":"https://bugzilla.suse.com/1121768","tags":["report"]},{"url":"https://bugzilla.suse.com/1122469","tags":["report"]},{"url":"https://bugzilla.suse.com/1138920","tags":["report"]},{"url":"https://bugzilla.suse.com/1139649","tags":["report"]},{"url":"https://bugzilla.suse.com/1142160","tags":["report"]},{"url":"https://bugzilla.suse.com/1142413","tags":["report"]},{"url":"https://bugzilla.suse.com/1143349","tags":["report"]},{"url":"https://bugzilla.suse.com/1150397","tags":["report"]},{"url":"https://bugzilla.suse.com/1153367","tags":["report"]},{"url":"https://bugzilla.suse.com/1157330","tags":["report"]},{"url":"https://bugzilla.suse.com/1158590","tags":["report"]},{"url":"https://bugzilla.suse.com/1170415","tags":["report"]},{"url":"https://bugzilla.suse.com/1170446","tags":["report"]},{"url":"https://bugzilla.suse.com/1172377","tags":["report"]},{"url":"https://bugzilla.suse.com/1174075","tags":["report"]},{"url":"https://bugzilla.suse.com/1176708","tags":["report"]},{"url":"https://bugzilla.suse.com/1178760","tags":["report"]},{"url":"https://bugzilla.suse.com/1178801","tags":["report"]},{"url":"https://bugzilla.suse.com/1180243","tags":["report"]},{"url":"https://bugzilla.suse.com/1180401","tags":["report"]},{"url":"https://bugzilla.suse.com/1182168","tags":["report"]},{"url":"https://bugzilla.suse.com/1188447","tags":["report"]},{"url":"https://bugzilla.suse.com/1190670","tags":["report"]},{"url":"https://bugzilla.suse.com/1191015","tags":["report"]},{"url":"https://bugzilla.suse.com/1191121","tags":["report"]},{"url":"https://bugzilla.suse.com/1191334","tags":["report"]},{"url":"https://bugzilla.suse.com/1191355","tags":["report"]},{"url":"https://bugzilla.suse.com/1191434","tags":["report"]},{"url":"https://bugzilla.suse.com/1192814","tags":["report"]},{"url":"https://bugzilla.suse.com/1193273","tags":["report"]},{"url":"https://bugzilla.suse.com/1193930","tags":["report"]},{"url":"https://bugzilla.suse.com/1197284","tags":["report"]},{"url":"https://bugzilla.suse.com/1197517","tags":["report"]},{"url":"https://bugzilla.suse.com/1200022","tags":["report"]},{"url":"https://bugzilla.suse.com/1200145","tags":["report"]},{"url":"https://bugzilla.suse.com/1205375","tags":["report"]},{"url":"https://bugzilla.suse.com/1206065","tags":["report"]},{"url":"https://bugzilla.suse.com/1208074","tags":["report"]},{"url":"https://bugzilla.suse.com/1210141","tags":["report"]},{"url":"https://bugzilla.suse.com/1210797","tags":["report"]},{"url":"https://bugzilla.suse.com/1211578","tags":["report"]},{"url":"https://bugzilla.suse.com/1212368","tags":["report"]},{"url":"https://bugzilla.suse.com/1213120","tags":["report"]},{"url":"https://bugzilla.suse.com/1213500","tags":["report"]},{"url":"https://bugzilla.suse.com/1214107","tags":["report"]},{"url":"https://bugzilla.suse.com/1214108","tags":["report"]},{"url":"https://bugzilla.suse.com/1214109","tags":["report"]},{"url":"https://bugzilla.suse.com/1215323","tags":["report"]},{"url":"https://bugzilla.suse.com/1217513","tags":["report"]},{"url":"https://bugzilla.suse.com/1219267","tags":["report"]},{"url":"https://bugzilla.suse.com/1219268","tags":["report"]},{"url":"https://bugzilla.suse.com/1219438","tags":["report"]},{"url":"https://bugzilla.suse.com/1240150","tags":["report"]},{"url":"https://bugzilla.suse.com/1247362","tags":["report"]},{"url":"https://bugzilla.suse.com/1250508","tags":["report"]},{"url":"https://bugzilla.suse.com/1250596","tags":["report"]},{"url":"https://bugzilla.suse.com/885209","tags":["report"]},{"url":"https://bugzilla.suse.com/907012","tags":["report"]},{"url":"https://bugzilla.suse.com/907014","tags":["report"]},{"url":"https://bugzilla.suse.com/908033","tags":["report"]},{"url":"https://bugzilla.suse.com/909709","tags":["report"]},{"url":"https://bugzilla.suse.com/909710","tags":["report"]},{"url":"https://bugzilla.suse.com/909712","tags":["report"]},{"url":"https://bugzilla.suse.com/913211","tags":["report"]},{"url":"https://bugzilla.suse.com/913213","tags":["report"]},{"url":"https://bugzilla.suse.com/920645","tags":["report"]},{"url":"https://bugzilla.suse.com/930235","tags":["report"]},{"url":"https://bugzilla.suse.com/931301","tags":["report"]},{"url":"https://bugzilla.suse.com/935570","tags":["report"]},{"url":"https://bugzilla.suse.com/938156","tags":["report"]},{"url":"https://bugzilla.suse.com/942369","tags":["report"]},{"url":"https://bugzilla.suse.com/942370","tags":["report"]},{"url":"https://bugzilla.suse.com/946653","tags":["report"]},{"url":"https://bugzilla.suse.com/949660","tags":["report"]},{"url":"https://bugzilla.suse.com/950931","tags":["report"]},{"url":"https://bugzilla.suse.com/953182","tags":["report"]},{"url":"https://bugzilla.suse.com/954737","tags":["report"]},{"url":"https://bugzilla.suse.com/954797","tags":["report"]},{"url":"https://bugzilla.suse.com/954812","tags":["report"]},{"url":"https://bugzilla.suse.com/956434","tags":["report"]},{"url":"https://bugzilla.suse.com/958255","tags":["report"]},{"url":"https://bugzilla.suse.com/959405","tags":["report"]},{"url":"https://bugzilla.suse.com/963142","tags":["report"]},{"url":"https://bugzilla.suse.com/964468","tags":["report"]},{"url":"https://bugzilla.suse.com/964673","tags":["report"]},{"url":"https://bugzilla.suse.com/965600","tags":["report"]},{"url":"https://bugzilla.suse.com/965918","tags":["report"]},{"url":"https://bugzilla.suse.com/968933","tags":["report"]},{"url":"https://bugzilla.suse.com/968972","tags":["report"]},{"url":"https://bugzilla.suse.com/970637","tags":["report"]},{"url":"https://bugzilla.suse.com/974208","tags":["report"]},{"url":"https://bugzilla.suse.com/976777","tags":["report"]},{"url":"https://bugzilla.suse.com/977394","tags":["report"]},{"url":"https://bugzilla.suse.com/978260","tags":["report"]},{"url":"https://bugzilla.suse.com/980555","tags":["report"]},{"url":"https://bugzilla.suse.com/983015","tags":["report"]},{"url":"https://bugzilla.suse.com/984942","tags":["report"]},{"url":"https://bugzilla.suse.com/987198","tags":["report"]},{"url":"https://bugzilla.suse.com/988408","tags":["report"]},{"url":"https://bugzilla.suse.com/988707","tags":["report"]},{"url":"https://bugzilla.suse.com/989566","tags":["report"]},{"url":"https://bugzilla.suse.com/993847","tags":["report"]},{"url":"https://bugzilla.suse.com/995058","tags":["report"]},{"url":"https://bugzilla.suse.com/995102","tags":["report"]},{"url":"https://bugzilla.suse.com/995620","tags":["report"]},{"url":"https://bugzilla.suse.com/996015","tags":["report"]},{"url":"https://bugzilla.suse.com/999582","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503545-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-16873","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16873","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/K5SY7VBRVPPL5WRVFFIC7CSECFNB3NGY/#K5SY7VBRVPPL5WRVFFIC7CSECFNB3NGY","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XWOQPNXXBRMZ3GUIAPIJWBLSX4C6UKIN/#XWOQPNXXBRMZ3GUIAPIJWBLSX4C6UKIN","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VC6NILQ66VPYH6KMNXONQWSWQWZS3YDD/#VC6NILQ66VPYH6KMNXONQWSWQWZS3YDD","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UBFTSNKGB464HWO65FTEXANGAGVXV4XW/#UBFTSNKGB464HWO65FTEXANGAGVXV4XW","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CER2ESZ3IMKBBAWOVTY65MHSHQAI2UVB/#CER2ESZ3IMKBBAWOVTY65MHSHQAI2UVB","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IF5UCHNMLYYGABZ53J2EKXLMRHH3UVO3/#IF5UCHNMLYYGABZ53J2EKXLMRHH3UVO3","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HM6FFITESF23XEYSCI7KTKZVCPQU2CMO/#HM6FFITESF23XEYSCI7KTKZVCPQU2CMO","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JECNV3BMXBNMPC6CIX5BMOAPGIHSNLAI/#JECNV3BMXBNMPC6CIX5BMOAPGIHSNLAI","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4KLMQUDJXG7ORWF7M42NKLDUJSKHAUTS/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1039663","tags":["report"]},{"url":"https://bugzilla.suse.com/1042383","tags":["report"]},{"url":"https://bugzilla.suse.com/1042387","tags":["report"]},{"url":"https://bugzilla.suse.com/1057277","tags":["report"]},{"url":"https://bugzilla.suse.com/1059207","tags":["report"]},{"url":"https://bugzilla.suse.com/1061027","tags":["report"]},{"url":"https://bugzilla.suse.com/1065972","tags":["report"]},{"url":"https://bugzilla.suse.com/1069469","tags":["report"]},{"url":"https://bugzilla.suse.com/1084765","tags":["report"]},{"url":"https://bugzilla.suse.com/1084766","tags":["report"]},{"url":"https://bugzilla.suse.com/1085009","tags":["report"]},{"url":"https://bugzilla.suse.com/1086412","tags":["report"]},{"url":"https://bugzilla.suse.com/1095131","tags":["report"]},{"url":"https://bugzilla.suse.com/1095154","tags":["report"]},{"url":"https://bugzilla.suse.com/1096773","tags":["report"]},{"url":"https://bugzilla.suse.com/1097473","tags":["report"]},{"url":"https://bugzilla.suse.com/1100838","tags":["report"]},{"url":"https://bugzilla.suse.com/1101010","tags":["report"]},{"url":"https://bugzilla.suse.com/1104598","tags":["report"]},{"url":"https://bugzilla.suse.com/1136403","tags":["report"]},{"url":"https://bugzilla.suse.com/1144065","tags":["report"]},{"url":"https://bugzilla.suse.com/1155323","tags":["report"]},{"url":"https://bugzilla.suse.com/1161056","tags":["report"]},{"url":"https://bugzilla.suse.com/1161179","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1002101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1002105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10214","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-16873","description":"In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named \".git\" by using a vanity import path that ends with \"/.git\". If the Git repository root contains a \"HEAD\" file, a \"config\" file, an \"objects\" directory, a \"refs\" directory, with some work to ensure the proper ordering of operations, \"go get -u\" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the \"config\" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running \"go get -u\".","status":"published","published":"2018-12-14T14:00:00Z","modified":"2024-08-05T10:32:54.055Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:11.426178Z"}],"euvd":[{"id":"EUVD-2018-8664","description":"In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named \".git\" by using a vanity import path that ends with \"/.git\". If the Git repository root contains a \"HEAD\" file, a \"config\" file, an \"objects\" directory, a \"refs\" directory, with some work to ensure the proper ordering of operations, \"go get -u\" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the \"config\" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running \"go get -u\".","status":"published","published":"2018-12-14T14:00:00Z","modified":"2024-08-05T10:32:54Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T02:39:40.316949Z"}],"ghsa":[{"id":"GHSA-q6pp-3q54-qw37","title":"In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to remote code...","description":"In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named \".git\" by using a vanity import path that ends with \"/.git\". If the Git repository root contains a \"HEAD\" file, a \"config\" file, an \"objects\" directory, a \"refs\" directory, with some work to ensure the proper ordering of operations, \"go get -u\" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the \"config\" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running \"go get -u\".","status":"published","published":"2022-05-13T01:11:23Z","modified":"2023-02-01T05:03:36Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:50:05.01868Z"}],"nvd":[{"id":"CVE-2018-16873","description":"In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named \".git\" by using a vanity import path that ends with \"/.git\". If the Git repository root contains a \"HEAD\" file, a \"config\" file, an \"objects\" directory, a \"refs\" directory, with some work to ensure the proper ordering of operations, \"go get -u\" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the \"config\" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running \"go get -u\".","status":"published","published":"2018-12-14T14:29:00.227Z","modified":"2026-06-17T01:44:57.767Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:50.99633Z"}],"osv":[{"id":"BELL-CVE-2018-16873","title":"CVE-2018-16873 does not affect BellSoft software","status":"withdrawn","published":"2018-12-14T14:29:00Z","modified":"2026-01-26T09:48:43.850848Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-16873","description":"In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named \".git\" by using a vanity import path that ends with \"/.git\". If the Git repository root contains a \"HEAD\" file, a \"config\" file, an \"objects\" directory, a \"refs\" directory, with some work to ensure the proper ordering of operations, \"go get -u\" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the \"config\" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running \"go get -u\".","status":"published","published":"2018-12-14T14:29:00.227Z","modified":"2026-10-24T10:30:53.584980333Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"UBUNTU-CVE-2018-16873","description":"In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named \".git\" by using a vanity import path that ends with \"/.git\". If the Git repository root contains a \"HEAD\" file, a \"config\" file, an \"objects\" directory, a \"refs\" directory, with some work to ensure the proper ordering of operations, \"go get -u\" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the \"config\" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running \"go get -u\".","status":"published","published":"2018-12-14T14:29:00Z","modified":"2025-10-24T04:47:12Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"DLA-2591-1","title":"golang-1.7 - security update","status":"published","published":"2021-03-13T00:00:00Z","modified":"2026-03-09T01:21:14.067767Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-2592-1","title":"golang-1.8 - security update","status":"published","published":"2021-03-13T00:00:00Z","modified":"2026-03-09T01:19:13.580096Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"GO-2022-0189","title":"Remote command execution via \"go get\" with \"-u\" flag in cmd/go","description":"The \"go get\" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly.\n\nSpecifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get).\n\nUsing custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named \".git\" by using a vanity import path that ends with \"/.git\". If the Git repository root contains a \"HEAD\" file, a \"config\" file, an \"objects\" directory, a \"refs\" directory, with some work to ensure the proper ordering of operations, \"go get -u\" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the \"config\" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running \"go get -u\".\n\nNote that forbidding import paths with a .git element might not be sufficient to mitigate this issue, as on certain systems there can be other aliases for VCS state folders.","status":"published","published":"2022-08-04T21:30:35Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2019-0066","title":"Updated golang packages fix security vulnerability","description":"Remote code execution in go get, when executed with the -u flag\n(CVE-2018-16873).\n\nAn arbitrary filesystem write in go get, which could lead to code execution\n(CVE-2018-16874).\n\nDenial of Service in the crypto/x509 package during certificate chain\nvalidation (CVE-2018-16875).\n\nGo before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows\nattackers to cause a denial of service (CPU consumption) or possibly conduct\nECDH private key recovery attacks (CVE-2019-6486).\n","status":"published","published":"2019-02-13T11:08:25Z","modified":"2026-04-16T04:44:46.119665677Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2019-0180","title":"Updated docker packages fix security vulnerability","description":"Security issues fixed for containerd, docker, docker-runc and\ngolang-github-docker-libnetwork:\n\nCVE-2018-16873: cmd/go: remote command execution during \"go get -u\"\n(bsc#1118897)\nCVE-2018-16874: cmd/go: directory traversal in \"go get\" via curly braces\nin import paths (bsc#1118898)\nCVE-2018-16875: crypto/x509: CPU denial of service (bsc#1118899)\n\nNon-security issues fixed for docker:\n\nDisable leap based builds for kubic flavor (bsc#1121412)\nAllow users to explicitly specify the NIS domainname of a container\n(bsc#1001161)\nUpdate docker.service to match upstream and avoid rlimit problems\n(bsc#1112980)\nAllow docker images larger then 23GB (bsc#1118990)\nDocker version update to version 18.09.0-ce (bsc#1115464)\n","status":"published","published":"2019-05-19T11:27:30Z","modified":"2026-04-16T04:41:18.927921912Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0170-1","title":"Security update for runc","description":"This update for runc fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid\n  write attacks to the host runc binary, which could lead to a container\n  breakout (bsc#1121967)\n- CVE-2018-16873: Fix a remote command execution during 'go get -u'\n  (boo#1118897)\n- CVE-2018-16874: Fix a directory traversal in 'go get' via curly braces in\n  import paths (boo#1118898)\n- CVE-2018-16875: Fix a CPU denial of service issue (boo#1118899)\n\nOther changes and bug fixes:\n\n- Update go requirements to \u003e= go1.10\n- Create a symlink in /usr/bin/runc to enable rootless Podman and Buildah.\n- Make use of %license macro\n- Remove 'go test' from %check section, as it has only ever caused us problems\n  and hasn't (as far as I remember) ever caught a release-blocking issue. Smoke\n  testing has been far more useful. (boo#1095817)\n- Upgrade to runc v1.0.0~rc6. Upstream changelog is available from\n  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc6\n","status":"published","published":"2019-02-13T16:51:49Z","modified":"2026-02-04T02:56:36.278074Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:0189-1","title":"Security update for docker","description":"This update for containerd, docker, docker-runc and golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issues fixed for containerd, docker, docker-runc and golang-github-docker-libnetwork:\n\n- CVE-2018-16873: cmd/go: remote command execution during 'go get -u' (bsc#1118897)\n- CVE-2018-16874: cmd/go: directory traversal in 'go get' via curly braces in import paths (bsc#1118898)\n- CVE-2018-16875: crypto/x509: CPU denial of service (bsc#1118899)\n\nNon-security issues fixed for docker:\n\n- Disable leap based builds for kubic flavor (bsc#1121412)\n- Allow users to explicitly specify the NIS domainname of a container (bsc#1001161)\n- Update docker.service to match upstream and avoid rlimit problems (bsc#1112980)\n- Allow docker images larger then 23GB (bsc#1118990)\n- Docker version update to version 18.09.0-ce (bsc#1115464)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T11:00:22Z","modified":"2026-02-04T04:07:09.58536Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:0208-1","title":"Security update for runc","description":"This update for runc fixes the following issues:\n\nSecurity vulnerablities addressed:\n\n- CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid\n  write attacks to the host runc binary, which could lead to a container\n  breakout (bsc#1121967)\n- CVE-2018-16873: Fix a remote command execution during 'go get -u'\n  (boo#1118897)\n- CVE-2018-16874: Fix a directory traversal in 'go get' via curly braces in\n  import paths (boo#1118898)\n- CVE-2018-16875: Fix a CPU denial of service issue (boo#1118899)\n\nOther changes and bug fixes:\n\n- Update go requirements to \u003e= go1.10\n- Create a symlink in /usr/bin/runc to enable rootless Podman and Buildah.\n- Make use of %license macro\n- Remove 'go test' from %check section, as it has only ever caused us problems\n  and hasn't (as far as I remember) ever caught a release-blocking issue. Smoke\n  testing has been far more useful. (boo#1095817)\n- Upgrade to runc v1.0.0~rc6. Upstream changelog is available from\n  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc6\n","status":"published","published":"2019-03-23T11:03:28Z","modified":"2026-02-04T03:35:28.069313Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:0295-1","title":"Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc","description":"This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues:\n\nSecurity issues fixed: \n\n- CVE-2018-16875: Fixed a CPU Denial of Service (bsc#1118899).\n- CVE-2018-16874: Fixed a vulnerabity in go get command which could allow directory traversal in GOPATH mode (bsc#1118898).\n- CVE-2018-16873: Fixed a vulnerability in go get command which could allow remote code execution when executed with -u in GOPATH mode (bsc#1118897).\n- CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container\n  breakout (bsc#1121967).\n\nOther changes and fixes: \n\n- Update shell completion to use Group: System/Shells.\n- Add daemon.json file with rotation logs configuration (bsc#1114832)\n- Update to Docker 18.09.1-ce (bsc#1124308) and to to runc 96ec2177ae84.\n  See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md.\n- Update go requirements to \u003e= go1.10 \n- Use -buildmode=pie for tests and binary build (bsc#1048046 and bsc#1051429).\n- Remove the usage of 'cp -r' to reduce noise in the build logs.\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T11:11:59Z","modified":"2026-02-04T03:31:46.538385Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:1444-1","title":"Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork","description":"This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).\n- CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).\n- CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).\n- CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).\n- CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).\n\nOther changes and bug fixes:\n\n- Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).\n- docker-test: Improvements to test packaging (bsc#1128746).\n- Move daemon.json file to /etc/docker directory (bsc#1114832).\n- Revert golang(API) removal since it turns out this breaks \u003e= requires in certain cases (bsc#1114209).\n- Fix go build failures (bsc#1121397).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-05-27T05:09:20Z","modified":"2026-02-04T04:13:40.567028Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1499-1","title":"Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork","description":"This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).\n- CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).\n- CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).\n- CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).\n- CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).\n\nOther changes and bug fixes:\n\n- Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).\n- docker-test: Improvements to test packaging (bsc#1128746).\n- Move daemon.json file to /etc/docker directory (bsc#1114832).\n- Revert golang(API) removal since it turns out this breaks \u003e= requires in certain cases (bsc#1114209).\n- Fix go build failures (bsc#1121397).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-06-03T08:21:16Z","modified":"2026-02-04T04:10:51.06425Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1506-1","title":"Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork","description":"This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).\n- CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).\n- CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).\n- CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).\n- CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).\n\nOther changes and bug fixes:\n\n- Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).\n- docker-test: Improvements to test packaging (bsc#1128746).\n- Move daemon.json file to /etc/docker directory (bsc#1114832).\n- Revert golang(API) removal since it turns out this breaks \u003e= requires in certain cases (bsc#1114209).\n- Fix go build failures (bsc#1121397).\n\nThis update was imported from the SUSE:SLE-15:Update update project.\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-06-03T11:22:06Z","modified":"2026-02-04T02:41:42.913839Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1703-1","title":"Security update for helm","description":"This update for helm to version 2.13.1 fixes the following issues:\n\n- set correct git_commit value so that 'helm version' reports correctly\n- added service file for helm-serve\n- Require golang 1.10.6  or newer\n- Tiller should only enforce what we expect from Helm\n- Keepalive config should be independent of TLS\n- Bump client side grpc max msg size\n- Update deprecated grpc dial timeout\n- Includes fixes which allow Helm to correctly recognize\n  resources created using the K8S 1.8/1.9 API namespaces\n","status":"published","published":"2019-07-14T06:24:35Z","modified":"2026-02-04T04:07:46.325903Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2020:0554-1","title":"Security update for kubernetes","description":"\nThis update introduces kubernetes version 1.14.1 and cri-o 1.17.1 to Leap 15.1.\n","status":"published","published":"2020-04-26T14:12:22Z","modified":"2026-02-04T03:11:17.147759Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10693-1","title":"containerd-1.4.8-2.2 on GA media","description":"These are all security issues fixed in the containerd-1.4.8-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:33:56.633182Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10699-1","title":"cri-o-1.22.0-1.2 on GA media","description":"These are all security issues fixed in the cri-o-1.22.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:17:00.222047Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10722-1","title":"docker-20.10.6_ce-2.1 on GA media","description":"These are all security issues fixed in the docker-20.10.6_ce-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:33:31.003813Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10741-1","title":"etcd-3.4.16-3.1 on GA media","description":"These are all security issues fixed in the etcd-3.4.16-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:40:16.016886Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10761-1","title":"flannel-0.14.0-1.2 on GA media","description":"These are all security issues fixed in the flannel-0.14.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:25:39.06643Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10802-1","title":"go-1.17-1.1 on GA media","description":"These are all security issues fixed in the go-1.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:22.419368Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10803-1","title":"go1.10-1.10.8-8.2 on GA media","description":"These are all security issues fixed in the go1.10-1.10.8-8.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:41.250328Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10804-1","title":"go1.11-1.11.13-10.5 on GA media","description":"These are all security issues fixed in the go1.11-1.11.13-10.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:47.136272Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10805-1","title":"go1.12-1.12.17-4.8 on GA media","description":"These are all security issues fixed in the go1.12-1.12.17-4.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:28:31.331263Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10841-1","title":"helm-3.6.3-1.1 on GA media","description":"These are all security issues fixed in the helm-3.6.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:57:29.644492Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:10842-1","title":"helm-mirror-0.3.1-1.9 on GA media","description":"These are all security issues fixed in the helm-mirror-0.3.1-1.9 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:45:55.431315Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11358-1","title":"runc-1.0.2-1.2 on GA media","description":"These are all security issues fixed in the runc-1.0.2-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:01:48.763706Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2025:15589-1","title":"docker-stable-24.0.9_ce-15.1 on GA media","description":"These are all security issues fixed in the docker-stable-24.0.9_ce-15.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-30T00:00:00Z","modified":"2026-03-23T04:53:58.562077Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15779-1","title":"helm3-3.19.2-1.1 on GA media","description":"These are all security issues fixed in the helm3-3.19.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-28T00:00:00Z","modified":"2026-02-04T03:10:43.123465Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"SUSE-SU-2018:4297-1","title":"Security update for containerd, docker and go","description":"\nThis update for containerd, docker and go fixes the following issues:\n\ncontainerd and docker:\n\n- Add backport for building containerd (bsc#1102522, bsc#1113313)\n- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.\n  (bsc#1102522)\n- Enable seccomp support on SLE12 (fate#325877)\n- Update to containerd v1.1.1, which is the required version for the Docker\n  v18.06.0-ce upgrade. (bsc#1102522)\n- Put containerd under the podruntime slice (bsc#1086185) \n- 3rd party registries used the default Docker certificate (bsc#1084533)\n- Handle build breakage due to missing 'export GOPATH' (caused by resolution of\n  boo#1119634). I believe Docker is one of the only packages with this problem.\n\ngo:\n  \n- golang: arbitrary command execution via VCS path (bsc#1081495, CVE-2018-7187)\n- Make profile.d/go.sh no longer set GOROOT=, in order to make switching\n  between versions no longer break. This ends up removing the need for go.sh\n  entirely (because GOPATH is also set automatically) (boo#1119634)\n- Fix a regression that broke go get for import path patterns containing '...'\n  (bsc#1119706)\n\nAdditionally, the package go1.10 has been added.\n","status":"published","published":"2018-12-28T17:39:11Z","modified":"2026-02-04T04:26:39.006391Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0048-1","title":"Security update for helm-mirror","description":"This update for helm-mirror to version 0.2.1 fixes the following issues:\n\n\nSecurity issues fixed:\n\n- CVE-2018-16873: Fixed a remote command execution (bsc#1118897)\n- CVE-2018-16874: Fixed a directory traversal in 'go get' via curly braces in import path (bsc#1118898)\n- CVE-2018-16875: Fixed a CPU denial of service (bsc#1118899)\n\nNon-security issue fixed:\n\n- Update to v0.2.1 (bsc#1120762)\n- Include helm-mirror into the containers module (bsc#1116182)\n","status":"published","published":"2019-01-09T16:24:57Z","modified":"2026-02-04T04:34:35.535399Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0048-2","title":"Security update for helm-mirror","description":"This update for helm-mirror to version 0.2.1 fixes the following issues:\n\n\nSecurity issues fixed:\n\n- CVE-2018-16873: Fixed a remote command execution (bsc#1118897)\n- CVE-2018-16874: Fixed a directory traversal in 'go get' via curly braces in import path (bsc#1118898)\n- CVE-2018-16875: Fixed a CPU denial of service (bsc#1118899)\n\nNon-security issue fixed:\n\n- Update to v0.2.1 (bsc#1120762)\n- Include helm-mirror into the containers module (bsc#1116182)\n","status":"published","published":"2019-07-04T12:26:14Z","modified":"2026-02-04T03:17:59.460446Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0286-1","title":"Security update for docker","description":"This update for containerd, docker, docker-runc and golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issues fixed for containerd, docker, docker-runc and golang-github-docker-libnetwork:\n\n- CVE-2018-16873: cmd/go: remote command execution during 'go get -u' (bsc#1118897)\n- CVE-2018-16874: cmd/go: directory traversal in 'go get' via curly braces in import paths (bsc#1118898)\n- CVE-2018-16875: crypto/x509: CPU denial of service (bsc#1118899)\n\nNon-security issues fixed for docker:\n\n- Disable leap based builds for kubic flavor (bsc#1121412)\n- Allow users to explicitly specify the NIS domainname of a container (bsc#1001161)\n- Update docker.service to match upstream and avoid rlimit problems (bsc#1112980)\n- Allow docker images larger then 23GB (bsc#1118990)\n- Docker version update to version 18.09.0-ce (bsc#1115464)\n","status":"published","published":"2019-02-07T12:45:30Z","modified":"2026-02-04T02:21:33.192526Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0495-1","title":"Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc","description":"This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues:\n\nSecurity issues fixed: \n\n- CVE-2018-16875: Fixed a CPU Denial of Service (bsc#1118899).\n- CVE-2018-16874: Fixed a vulnerabity in go get command which could allow directory traversal in GOPATH mode (bsc#1118898).\n- CVE-2018-16873: Fixed a vulnerability in go get command which could allow remote code execution when executed with -u in GOPATH mode (bsc#1118897).\n- CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container\n  breakout (bsc#1121967).\n\nOther changes and fixes: \n\n- Update shell completion to use Group: System/Shells.\n- Add daemon.json file with rotation logs configuration (bsc#1114832)\n- Update to Docker 18.09.1-ce (bsc#1124308) and to to runc 96ec2177ae84.\n  See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md.\n- Update go requirements to \u003e= go1.10 \n- Use -buildmode=pie for tests and binary build (bsc#1048046 and bsc#1051429).\n- Remove the usage of 'cp -r' to reduce noise in the build logs.\n","status":"published","published":"2019-02-26T15:42:38Z","modified":"2026-02-04T03:55:49.96411Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0573-1","title":"Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc","description":"This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-16875: Fixed a CPU Denial of Service (bsc#1118899).\n- CVE-2018-16874: Fixed a vulnerabity in go get command which could allow directory traversal in GOPATH mode (bsc#1118898).\n- CVE-2018-16873: Fixed a vulnerability in go get command which could allow remote code execution when executed with -u in GOPATH mode (bsc#1118897).\n- CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container\n  breakout (bsc#1121967).\n\nOther changes and bug fixes:\n\n- Update shell completion to use Group: System/Shells.\n- Add daemon.json file with rotation logs configuration (bsc#1114832)\n- Update to Docker 18.09.1-ce (bsc#1124308) and to to runc 96ec2177ae84.\n  See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md.\n- Disable leap based builds for kubic flavor (bsc#1121412).\n- Allow users to explicitly specify the NIS domain name of a container (bsc#1001161).\n- Update docker.service to match upstream and avoid rlimit problems (bsc#1112980).\n- Update go requirements to \u003e= go1.10 \n- Use -buildmode=pie for tests and binary build (bsc#1048046 and bsc#1051429).\n- Remove the usage of 'cp -r' to reduce noise in the build logs.\n","status":"published","published":"2019-03-08T12:49:44Z","modified":"2026-02-04T04:12:12.336004Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1234-1","title":"Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork","description":"This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).\n- CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).\n- CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).\n- CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).\n- CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).\n\nOther changes and bug fixes:\n\n- Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).\n- docker-test: Improvements to test packaging (bsc#1128746).\n- Move daemon.json file to /etc/docker directory (bsc#1114832).\n- Revert golang(API) removal since it turns out this breaks \u003e= requires in certain cases (bsc#1114209).\n- Fix go build failures (bsc#1121397).\n","status":"published","published":"2019-05-14T16:31:56Z","modified":"2026-02-04T04:31:28.603199Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1234-2","title":"Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork","description":"This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).\n- CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).\n- CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).\n- CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).\n- CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).\n\nOther changes and bug fixes:\n\n- Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).\n- Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).\n- docker-test: Improvements to test packaging (bsc#1128746).\n- Move daemon.json file to /etc/docker directory (bsc#1114832).\n- Revert golang(API) removal since it turns out this breaks \u003e= requires in certain cases (bsc#1114209).\n- Fix go build failures (bsc#1121397).\n","status":"published","published":"2019-06-13T13:28:57Z","modified":"2026-02-04T03:05:38.061456Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1264-1","title":"Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork","description":"This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).\n- CVE-2018-16873: go security release, fixing cmd/go remote command execution (bsc#1118897).\n- CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).\n- CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).\n\nOther changes and bug fixes:\n\n- Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, boo#1134068).\n- Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, boo#1134068).\n- Update to Docker 18.09.6-ce see upstream changelog in the packaged\n- Move daemon.json file to /etc/docker directory (bsc#1114832).\n- docker-test: Improvements to test packaging (bsc#1128746).\n- Update to go1.11.9 (released 2019/04/11)\n- Fix go build failures (bsc#1121397).\n- Update to golang-github-docker-libnetwork version git.872f0a83c98add6cae255c8859e29532febc0039 which is required for Docker v18.09.6-ce.\n- Revert golang(API) removal since it turns out this breaks \u003e= requires in certain cases (bsc#1114209).\n","status":"published","published":"2019-05-16T07:50:31Z","modified":"2026-02-04T03:41:36.790383Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2021:1458-1","title":"Security update for containerd, docker, runc","description":"This update for containerd, docker, runc fixes the following issues:\n\n- Docker was updated to 20.10.6-ce\n  *  Switch version to use -ce suffix rather than _ce to avoid confusing other\n     tools (bsc#1182476).\n  * CVE-2021-21284: Fixed a potential privilege escalation when the root user in \n    the remapped namespace has access to the host filesystem (bsc#1181732)\n  * CVE-2021-21285: Fixed an issue where pulling a malformed Docker image manifest \n    crashes the dockerd daemon (bsc#1181730). \n\n- runc was updated to  v1.0.0~rc93 (bsc#1182451 and bsc#1184962).\n  * Use the upstream runc package (bsc#1181641, bsc#1181677, bsc#1175821).\n  * Fixed /dev/null is not available (bsc#1168481).\n  * Fixed an issue where podman hangs when spawned by salt-minion process (bsc#1149954).\n  * CVE-2019-19921: Fixed a race condition with shared mounts (bsc#1160452).\n  * CVE-2019-16884: Fixed an LSM bypass via malicious Docker image that mount \n    over a /proc directory (bsc#1152308).\n  * CVE-2019-5736: Fixed potential write attacks to the host runc binary (bsc#1121967).\n  * Fixed an issue where after a kernel-update docker doesn't run (bsc#1131314 bsc#1131553)\n  * Ensure that we always include the version information in runc (bsc#1053532).\n  \n- Switch to Go 1.13 for build.\n  * CVE-2018-16873: Fixed a potential remote code execution (bsc#1118897).\n  * CVE-2018-16874: Fixed a directory traversal in 'go get' via curly braces \n    in import paths (bsc#1118898).\n  * CVE-2018-16875: Fixed a CPU denial of service (bsc#1118899).\n  * Fixed an issue with building containers (bsc#1095817).\n\n- containerd was updated to v1.4.4\n  * CVE-2021-21334: Fixed a potential information leak through environment variables (bsc#1183397).\n  * Handle a requirement from docker (bsc#1181594).\n  * Install the containerd-shim* binaries and stop creating (bsc#1183024).\n  * update version to the one required by docker (bsc#1034053)\n\n- Use -buildmode=pie for tests and binary build (bsc#1048046, bsc#1051429)\n- Cleanup seccomp builds similar (bsc#1028638).\n- Update to handle the docker-runc removal, and drop the -kubic flavour (bsc#1181677, bsc#1181749)\n","status":"published","published":"2021-04-30T10:58:51Z","modified":"2026-02-04T02:16:12.876879Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2024:3656-1","title":"Security update for etcd","description":"This update for etcd fixes the following issues:\n\nUpdate to version 3.5.12:\n\nSecurity fixes:\n\n- CVE-2018-16873: Fixed remote command execution in cmd/go (bsc#1118897)\n- CVE-2018-16874: Fixed directory traversal in cmd/go (bsc#1118898)\n- CVE-2018-16875: Fixed CPU denial of service in crypto/x509 (bsc#1118899)\n- CVE-2018-16886: Fixed improper authentication issue when RBAC and client-cert-auth is enabled (bsc#1121850)\n- CVE-2020-15106: Fixed panic in decodeRecord method (bsc#1174951)\n- CVE-2020-15112: Fixed improper checks in entry index (bsc#1174951)\n- CVE-2021-28235: Fixed information discosure via debug function (bsc#1210138)\n- CVE-2022-41723: Fixed quadratic complexity in HPACK decoding in net/http (bsc#1208270, bsc#1208297)\n- CVE-2023-29406: Fixed insufficient sanitization of Host header in go net/http (bsc#1213229)\n- CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (bsc#1217070)\n- CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (aka Terrapin Attack) in crypto/ssh (bsc#1217950, bsc#1218150)\n\nOther changes:\n\n- Added hardening to systemd service(s) (bsc#1181400)\n- Fixed static /tmp file issue (bsc#1199031)\n- Fixed systemd service not starting (bsc#1183703)\n\nFull changelog:\n\nhttps://github.com/etcd-io/etcd/compare/v3.3.1...v3.5.12\n","status":"published","published":"2024-10-16T11:33:42Z","modified":"2026-02-04T02:49:49.268837Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2025:03540-1","title":"Security update for docker-stable","description":"This update for docker-stable fixes the following issues:\n\n- Include historical changelog data from before the docker-stable fork. The\n  initial changelog entry did technically provide all the necessary\n  information, but our CVE tracking tools do not understand how the package is\n  forked and so it seems that this package does not include fixes for ~12 years\n  of updates. So, include a copy of the original package's changelog up until\n  the fork point. (bsc#1250596)\n\n- Remove git-core recommends on SLE. Most SLE systems have\n  installRecommends=yes by default and thus end up installing git with Docker.\n  bsc#1250508\n\n  This feature is mostly intended for developers ('docker build git://') so\n  most users already have the dependency installed, and the error when git is\n  missing is fairly straightforward (so they can easily figure out what they\n  need to install).\n\n- Backport \u003chttps://github.com/moby/moby/pull/48517\u003e. bsc#1247362\n\n- Update to docker-buildx v0.25.0. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.25.0\u003e\n\n- Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as\n  Docker does not have permission to access the host zypper credentials in this\n  mode (and unprivileged users cannot disable the feature using\n  /etc/docker/suse-secrets-enable.) bsc#1240150\n\n- Initial docker-stable fork, forked from Docker 24.0.7-ce release\n  (packaged on 2024-02-14). The original changelog is included below for\n  historical reference.\n","status":"published","published":"2025-10-10T19:04:02Z","modified":"2026-02-04T02:38:37.010407Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:03545-1","title":"Security update for docker-stable","description":"This update for docker-stable fixes the following issues:\n\nNote this update contains a already fixed references mostly.\n\n- Remove git-core recommends on SLE to avoid pulling it in unnecessary. (bsc#1250508)\n\n  This feature is mostly intended for developers ('docker build git://') so\n  most users already have the dependency installed, and the error when git is\n  missing is fairly straightforward (so they can easily figure out what they\n  need to install).\n\n- Include historical changelog data from before the docker-stable fork. The\n  initial changelog entry did technically provide all the necessary\n  information, but our CVE tracking tools do not understand how the package is\n  forked and so it seems that this package does not include fixes for ~12 years\n  of updates. So, include a copy of the original package's changelog up until\n  the fork point. bsc#1250596\n\n- Update to docker-buildx v0.25.0. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.25.0\u003e\n\n- Update to Go 1.23 for building now that upstream has switched their 23.0.x\n  LTSS to use Go 1.23.\n\n- Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as\n  Docker does not have permission to access the host zypper credentials in this\n  mode (and unprivileged users cannot disable the feature using\n  /etc/docker/suse-secrets-enable.) bsc#1240150\n\n- Initial docker-stable fork, forked from Docker 24.0.7-ce release\n  (packaged on 2024-02-14). The original changelog is included below for\n  historical reference.\n","status":"published","published":"2025-10-11T01:20:50Z","modified":"2026-03-23T04:48:05.17767Z","updated_at":"2026-11-02T15:53:58.883365Z"}]}}