Skip to content
OpenAdvisories
Unscored RHSA-2018:0878 3 CVEs

Red Hat Security Advisory: golang security, bug fix, and enhancement update

Published Sep 16, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::server golang 0:1.9.4-1.el7
Red Hat · RHEL 7 enterprise_linux:7::server golang-bin 0:1.9.4-1.el7
Red Hat · RHEL 7 enterprise_linux:7::server golang-docs 0:1.9.4-1.el7
Red Hat · RHEL 7 enterprise_linux:7::server golang-misc 0:1.9.4-1.el7
Red Hat · RHEL 7 enterprise_linux:7::server golang-src 0:1.9.4-1.el7
Red Hat · RHEL 7 enterprise_linux:7::server golang-tests 0:1.9.4-1.el7

Vulnerabilities 3

  • Unscored —
    CVE-2017-15041

    Remote command execution via "go get" in cmd/go

    Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Sub…

    golang-1.8 golang-1.6 toolchain Ubuntu Go
  • Unscored —
    CVE-2017-15042

    Cleartext transmission of credentials in net/smtp

    An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enfor…

    golang stdlib golang-1.8 golang-1.6 Ubuntu Azure Linux Go
  • Unscored —
    CVE-2018-6574 Public exploit

    Remote command execution via "go get" command with cgo in cmd/go

    Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

    go golang-1.8 golang-1.6 toolchain Ubuntu Alpine Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/7/html/7.5_release_notes/index.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1498867
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1498870
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1543561
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0878.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-15041
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-15041
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-15041
  • report
    https://access.redhat.com/security/cve/CVE-2017-15042
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-15042
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-15042
  • report
    https://access.redhat.com/security/cve/CVE-2018-6574
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-6574
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-6574