{"id":"CVE-2018-6574","aliases":["ALPINE-CVE-2018-6574","BELL-CVE-2018-6574","DSA-4380-1","EUVD-2018-18324","GHSA-c37c-qq99-c897","GO-2022-0201","MGASA-2018-0144","RHSA-2018:0878","RHSA-2018:1304","UBUNTU-CVE-2018-6574","openSUSE-SU-2018:0588-1","openSUSE-SU-2018:0589-1","openSUSE-SU-2018:0628-1","openSUSE-SU-2018:0629-1","openSUSE-SU-2024:10802-1","openSUSE-SU-2024:10803-1","openSUSE-SU-2024:10804-1","openSUSE-SU-2024:10805-1","openSUSE-SU-2024:10812-1"],"status":"published","title":"Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow \"go get\"...","description":"Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow \"go get\" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.07625,"percentile":0.94603,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2018-02-07T21:00:00Z","modified":"2026-11-03T06:31:31Z","exploits":[{"source":"pocgithub","id":"acole76/cve-2018-6574","title":"acole76/cve-2018-6574","date":"2018-04-02","url":"https://github.com/acole76/cve-2018-6574"},{"source":"pocgithub","id":"neargle/Go-Get-RCE-CVE-2018-6574-POC","title":"neargle/Go-Get-RCE-CVE-2018-6574-POC","date":"2018-04-24","url":"https://github.com/neargle/Go-Get-RCE-CVE-2018-6574-POC"},{"source":"pocgithub","id":"wb4r/go-get-rce","title":"wb4r/go-get-rce","date":"2018-05-17","url":"https://github.com/wb4r/go-get-rce"},{"source":"pocgithub","id":"ahmetmanga/cve-2018-6574","title":"ahmetmanga/cve-2018-6574","date":"2018-05-20","url":"https://github.com/ahmetmanga/cve-2018-6574"},{"source":"pocgithub","id":"ahmetmanga/go-get-rce","title":"ahmetmanga/go-get-rce","date":"2018-05-20","url":"https://github.com/ahmetmanga/go-get-rce"},{"source":"pocgithub","id":"redirected/cve-2018-6574","title":"redirected/cve-2018-6574","date":"2018-11-01","url":"https://github.com/redirected/cve-2018-6574"},{"source":"pocgithub","id":"20matan/CVE-2018-6574-POC","title":"20matan/CVE-2018-6574-POC","date":"2018-12-16","url":"https://github.com/20matan/CVE-2018-6574-POC"},{"source":"pocgithub","id":"zur250/Zur-Go-GET-RCE-Solution","title":"zur250/Zur-Go-GET-RCE-Solution","date":"2018-12-25","url":"https://github.com/zur250/Zur-Go-GET-RCE-Solution"},{"source":"pocgithub","id":"mekhalleh/cve-2018-6574","title":"mekhalleh/cve-2018-6574","date":"2018-12-30","url":"https://github.com/mekhalleh/cve-2018-6574"},{"source":"pocgithub","id":"veter069/go-get-rce","title":"veter069/go-get-rce","date":"2019-01-10","url":"https://github.com/veter069/go-get-rce"},{"source":"pocgithub","id":"duckzsc2/CVE-2018-6574-POC","title":"duckzsc2/CVE-2018-6574-POC","date":"2019-01-18","url":"https://github.com/duckzsc2/CVE-2018-6574-POC"},{"source":"pocgithub","id":"qweraqq/CVE-2018-6574","title":"qweraqq/CVE-2018-6574","date":"2019-04-08","url":"https://github.com/qweraqq/CVE-2018-6574"},{"source":"pocgithub","id":"d4rkshell/go-get-rce","title":"d4rkshell/go-get-rce","date":"2019-04-19","url":"https://github.com/d4rkshell/go-get-rce"},{"source":"pocgithub","id":"chaosura/CVE-2018-6574","title":"chaosura/CVE-2018-6574","date":"2019-05-16","url":"https://github.com/chaosura/CVE-2018-6574"},{"source":"pocgithub","id":"french560/ptl6574","title":"french560/ptl6574","date":"2019-07-22","url":"https://github.com/french560/ptl6574"},{"source":"pocgithub","id":"InfoSecJack/CVE-2018-6574","title":"InfoSecJack/CVE-2018-6574","date":"2019-09-19","url":"https://github.com/InfoSecJack/CVE-2018-6574"},{"source":"pocgithub","id":"asavior2/CVE-2018-6574","title":"asavior2/CVE-2018-6574","date":"2019-10-28","url":"https://github.com/asavior2/CVE-2018-6574"},{"source":"pocgithub","id":"drset/golang","title":"drset/golang","date":"2019-11-29","url":"https://github.com/drset/golang"},{"source":"pocgithub","id":"frozenkp/CVE-2018-6574","title":"frozenkp/CVE-2018-6574","date":"2019-12-02","url":"https://github.com/frozenkp/CVE-2018-6574"},{"source":"pocgithub","id":"kev-ho/cve-2018-6574-payload","title":"kev-ho/cve-2018-6574-payload","date":"2020-01-02","url":"https://github.com/kev-ho/cve-2018-6574-payload"},{"source":"pocgithub","id":"sdosis/cve-2018-6574","title":"sdosis/cve-2018-6574","date":"2020-01-06","url":"https://github.com/sdosis/cve-2018-6574"},{"source":"pocgithub","id":"No1zy/CVE-2018-6574-PoC","title":"No1zy/CVE-2018-6574-PoC","date":"2020-01-18","url":"https://github.com/No1zy/CVE-2018-6574-PoC"},{"source":"pocgithub","id":"nthuong95/CVE-2018-6574","title":"nthuong95/CVE-2018-6574","date":"2020-03-04","url":"https://github.com/nthuong95/CVE-2018-6574"},{"source":"pocgithub","id":"AdriVillaB/CVE-2018-6574","title":"AdriVillaB/CVE-2018-6574","date":"2020-03-06","url":"https://github.com/AdriVillaB/CVE-2018-6574"},{"source":"pocgithub","id":"yitingfan/CVE-2018-6574_demo","title":"yitingfan/CVE-2018-6574_demo","date":"2020-03-16","url":"https://github.com/yitingfan/CVE-2018-6574_demo"}],"exploits_more":66,"fixes":[{"ecosystem":"Alpine:v3.10","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"go","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"go1.10","fixed_in":["1.9.4-r0"],"sources":["osv"]},{"ecosystem":"Go","package":"toolchain","fixed_in":["1.8.7","1.9.4"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"golang","fixed_in":["1.9.4-3.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7","fixed_in":["0:1.8-14.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-build","fixed_in":["0:1.8-14.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-golang","fixed_in":["0:1.8.7-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-golang-bin","fixed_in":["0:1.8.7-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-golang-docs","fixed_in":["0:1.8.7-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-golang-misc","fixed_in":["0:1.8.7-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-golang-src","fixed_in":["0:1.8.7-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-golang-tests","fixed_in":["0:1.8.7-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-runtime","fixed_in":["0:1.8-14.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-scldevel","fixed_in":["0:1.8-14.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-golang-race","fixed_in":["0:1.8.7-2.el7"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 12","package":"go","fixed_in":["1.9.4-15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 12","package":"go1.9","fixed_in":["1.9.4-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 12","package":"go1.8","fixed_in":["1.8.7-5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"go1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1+deb9u1"}]}],"versions":["1.8.1-1"],"bundled":3},{"source":"osv","ecosystem":"Go","package":"toolchain","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.7"},{"introduced":"1.9.0-0"},{"fixed":"1.9.4"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8-14.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8-14.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8-14.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-scldevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8-14.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"go-toolset-7-golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-2.el7"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"go1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"go1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"go1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"go1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.13-10.5"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.17-4.8"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-11.2"}]}],"bundled":9}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"golang","product":"go"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:1304","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0878","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4380","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/KINGSABRI/CVE-in-Ruby/tree/master/CVE-2018-6574","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://groups.google.com/forum/#%21topic/golang-nuts/sprOaQ5m3Dk","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://github.com/golang/go/issues/23672","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://groups.google.com/forum/#%21topic/golang-nuts/Gbhh1NxAjMU","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6574","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/golang-nuts/Gbhh1NxAjMU","tags":["report"]},{"url":"https://groups.google.com/forum/#!topic/golang-nuts/sprOaQ5m3Dk","tags":["report"]},{"url":"https://github.com/advisories/GHSA-c37c-qq99-c897"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-6574","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-6574","tags":["advisory"]},{"url":"https://go.googlesource.com/go/+/1dcb5836ad2c60776561da2923c70576ba2eefc6","tags":["fix"]},{"url":"https://go.dev/issue/23672","tags":["report"]},{"url":"https://groups.google.com/g/golang-nuts/c/Gbhh1NxAjMU","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0144.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22646","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/C4TOPVSIULS5EMGKZ6OHC6LNDR7QA7W3/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/7/html/7.5_release_notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1543561","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0878.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15041","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15041","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15042","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15042","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15042","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6574","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6574","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_developer_tools/2018.2/html/using_go_toolset/","tags":["article"]},{"url":"https://access.redhat.com/support/offerings/techpreview/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1536154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1550079","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1304.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-6574","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1080006","tags":["report"]},{"url":"https://bugzilla.suse.com/1082409","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17596","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-6574","description":"Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow \"go get\" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.","status":"published","published":"2018-02-07T21:00:00Z","modified":"2024-08-05T06:10:10.226Z","updated_at":"2026-11-02T14:35:05.961936Z"}],"euvd":[{"id":"EUVD-2018-18324","description":"Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow \"go get\" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.","status":"published","published":"2018-02-07T21:00:00Z","modified":"2024-08-05T06:10:10Z","updated_at":"2026-11-03T02:40:07.640255Z"}],"ghsa":[{"id":"GHSA-c37c-qq99-c897","title":"Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow \"go get\"...","description":"Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow \"go get\" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.","status":"published","published":"2022-05-13T01:53:07Z","modified":"2023-02-02T05:02:10Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:51:22.324244Z"}],"nvd":[{"id":"CVE-2018-6574","description":"Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow \"go get\" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.","status":"published","published":"2018-02-07T21:29:00.25Z","modified":"2026-06-17T02:02:02.267Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:04:22.897995Z"}],"osv":[{"id":"ALPINE-CVE-2018-6574","description":"Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow \"go get\" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.","status":"published","published":"2018-02-07T21:29:00.25Z","modified":"2026-11-03T06:31:31.318504858Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:18:23.800469Z"},{"id":"BELL-CVE-2018-6574","title":"CVE-2018-6574 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:33.211999Z","modified":"2026-01-26T09:47:35.312955Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-6574","description":"Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow \"go get\" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.","status":"published","published":"2018-02-07T21:29:00.25Z","modified":"2026-10-20T10:50:28.893891189Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"RHSA-2018:0878","title":"Red Hat Security Advisory: golang security, bug fix, and enhancement update","status":"published","published":"2024-09-16T00:48:22Z","modified":"2026-06-26T10:36:54Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1304","title":"Red Hat Security Advisory: go-toolset-7 and go-toolset-7-golang security and bug fix update","status":"published","published":"2024-09-16T00:48:34Z","modified":"2026-06-26T12:22:01.427681235Z","cvss":[{"version":"3.0","score":5.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2018-6574","description":"Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow \"go get\" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.","status":"published","published":"2018-02-07T21:29:00Z","modified":"2025-10-24T04:46:55Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"DSA-4380-1","title":"golang-1.8 - security update","status":"published","published":"2019-02-01T00:00:00Z","modified":"2026-03-09T02:09:57.151142Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"GO-2022-0201","title":"Remote command execution via \"go get\" command with cgo in cmd/go","description":"The \"go get\" command with cgo is vulnerable to remote command execution by leveraging the gcc or clang plugin feature.\n\nWhen cgo is enabled, the build step during \"go get\" invokes the host C compiler, gcc or clang, adding compiler flags specified in the Go source files. Both gcc and clang support a plugin mechanism in which a shared-library plugin is loaded into the compiler, as directed by compiler flags. This means that a Go package repository can contain an attack.so file along with a Go source file that says (for example) \"// #cgo CFLAGS: -fplugin=attack.so\" causing the attack plugin to be loaded into the host C compiler during the build. Gcc and clang plugins are completely unrestricted in their access to the host system.","status":"published","published":"2022-08-09T18:15:41Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2018-0144","title":"Updated golang packages fix security vulnerability","description":"Updated golang packages fix security vulnerabilities:\n\nGo before 1.9.4 allows \"go get\" remote command execution during source code\nbuild, by leveraging the gcc or clang plugin feature, because -fplugin= and\n-plugin= arguments were not blocked (CVE-2018-6574).\n","status":"published","published":"2018-02-26T16:23:22Z","modified":"2026-04-16T04:41:31.781044202Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2018:0588-1","title":"Security update for go","description":"This update for go fixes the following issues:\n\nSecurity issues fix in version 1.9.4:\n\n- CVE-2018-6574: 'go get' remote command execution during source code build (bsc#1080006).\n\nBug fixes:\n\n- bsc#1082409: Review dependencies (requires, recommends and supports).\n\nThis update was imported from the SUSE:SLE-12:Update update project.","status":"published","published":"2018-03-02T15:17:34Z","modified":"2026-02-04T02:19:10.985599Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2018:0589-1","title":"Security update for go","description":"This update for go fixes the following issues:\n\nSecurity issues fix in version 1.9.4:\n\n- CVE-2018-6574: 'go get' remote command execution during source code build (bsc#1080006).\n\nBug fixes:\n\n- bsc#1082409: Review dependencies (requires, recommends and supports).\n\nThis update was imported from the SUSE:SLE-12:Update update project.","status":"published","published":"2018-03-02T15:17:34Z","modified":"2025-05-02T04:30:00.004544Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2018:0628-1","title":"Security update for go1.8","description":"This update for go1.8 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-6574: 'go get' allows for remote command execution during source code build (bsc#1080006).\n\nBug fixes:\n\n- bsc#1082409: Review dependencies (requires, recommends and supports)\n\nThis update was imported from the SUSE:SLE-12:Update update project.","status":"published","published":"2018-03-07T07:34:01Z","modified":"2026-02-04T03:15:30.9255Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2018:0629-1","title":"Security update for go1.8","description":"This update for go1.8 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-6574: 'go get' allows for remote command execution during source code build (bsc#1080006).\n\nBug fixes:\n\n- bsc#1082409: Review dependencies (requires, recommends and supports)\n\nThis update was imported from the SUSE:SLE-12:Update update project.","status":"published","published":"2018-03-07T07:34:01Z","modified":"2026-02-04T04:35:37.976118Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10802-1","title":"go-1.17-1.1 on GA media","description":"These are all security issues fixed in the go-1.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:22.419368Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10803-1","title":"go1.10-1.10.8-8.2 on GA media","description":"These are all security issues fixed in the go1.10-1.10.8-8.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:41.250328Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10804-1","title":"go1.11-1.11.13-10.5 on GA media","description":"These are all security issues fixed in the go1.11-1.11.13-10.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:47.136272Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10805-1","title":"go1.12-1.12.17-4.8 on GA media","description":"These are all security issues fixed in the go1.12-1.12.17-4.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:28:31.331263Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10812-1","title":"go1.9-1.9.7-11.2 on GA media","description":"These are all security issues fixed in the go1.9-1.9.7-11.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:45.429147Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}