Skip to content
OpenAdvisories
Unscored RHSA-2018:1304 1 CVE

Red Hat Security Advisory: go-toolset-7 and go-toolset-7-golang security and bug fix update

Published Sep 16, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · Devtools 2018 devtools:2018 go-toolset-7 0:1.8-14.el7
Red Hat · Devtools 2018 devtools:2018 go-toolset-7-build 0:1.8-14.el7
Red Hat · Devtools 2018 devtools:2018 go-toolset-7-golang 0:1.8.7-2.el7
Red Hat · Devtools 2018 devtools:2018 go-toolset-7-golang-bin 0:1.8.7-2.el7
Red Hat · Devtools 2018 devtools:2018 go-toolset-7-golang-docs 0:1.8.7-2.el7
Red Hat · Devtools 2018 devtools:2018 go-toolset-7-golang-misc 0:1.8.7-2.el7
Red Hat · Devtools 2018 devtools:2018 go-toolset-7-golang-race 0:1.8.7-2.el7
Red Hat · Devtools 2018 devtools:2018 go-toolset-7-golang-src 0:1.8.7-2.el7
Red Hat · Devtools 2018 devtools:2018 go-toolset-7-golang-tests 0:1.8.7-2.el7
Red Hat · Devtools 2018 devtools:2018 go-toolset-7-runtime 0:1.8-14.el7
Red Hat · Devtools 2018 devtools:2018 go-toolset-7-scldevel 0:1.8-14.el7

Vulnerabilities 1

  • Unscored —
    CVE-2018-6574 Public exploit

    Remote command execution via "go get" command with cgo in cmd/go

    Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

    go golang-1.8 golang-1.6 toolchain Ubuntu Alpine Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_developer_tools/2018.2/html/using_go_toolset/
  • article
    https://access.redhat.com/support/offerings/techpreview/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1536154
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1543561
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1550079
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1304.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-6574
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-6574
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-6574