Candidate: CVE-2018-16873
PublicDate: 2018-12-14 14:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16873
 https://groups.google.com/forum/?pli=1#!topic/golang-announce/Kw31K8G7Fi0
Description:
 In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is
 vulnerable to remote code execution when executed with the -u flag and the
 import path of a malicious Go package, or a package that imports it
 directly or indirectly. Specifically, it is only vulnerable in GOPATH mode,
 but not in module mode (the distinction is documented at
 https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains,
 it's possible to arrange things so that a Git repository is cloned to a
 folder named ".git" by using a vanity import path that ends with "/.git".
 If the Git repository root contains a "HEAD" file, a "config" file, an
 "objects" directory, a "refs" directory, with some work to ensure the
 proper ordering of operations, "go get -u" can be tricked into considering
 the parent directory as a repository root, and running Git commands on it.
 That will use the "config" file in the original Git repository root for its
 configuration, and if that config file contains malicious commands, they
 will execute on the system running "go get -u".
Ubuntu-Description:
Notes:
 mdeslaur> Packages built using golang need to be rebuilt once the
 mdeslaur> vulnerability has been fixed. This CVE entry does not
 mdeslaur> list packages that need rebuilding outside of the main
 mdeslaur> repository or the Ubuntu variants with PPA overlays.
Bugs:
 https://github.com/golang/go/issues/29230
 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16873
Priority: medium
Discovered-by: Etienne Stalmans
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H [8.1 HIGH]
 nvd: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H [8.1 HIGH]

Patches_golang:
upstream_golang: needs-triage
precise/esm_golang: DNE
trusty_golang: ignored (reached end-of-life)
trusty/esm_golang: DNE (trusty was needs-triage)
xenial_golang: DNE
bionic_golang: DNE
cosmic_golang: DNE
disco_golang: DNE
eoan_golang: DNE
focal_golang: DNE
groovy_golang: DNE
hirsute_golang: DNE
impish_golang: DNE
jammy_golang: DNE
devel_golang: DNE

Patches_golang-1.6:
upstream_golang-1.6: needs-triage
precise/esm_golang-1.6: DNE
trusty_golang-1.6: ignored (reached end-of-life)
trusty/esm_golang-1.6: DNE (trusty was needs-triage)
xenial_golang-1.6: ignored (end of standard support, was needs-triage)
esm-infra/xenial_golang-1.6: needs-triage
bionic_golang-1.6: DNE
cosmic_golang-1.6: DNE
disco_golang-1.6: DNE
eoan_golang-1.6: DNE
focal_golang-1.6: DNE
groovy_golang-1.6: DNE
hirsute_golang-1.6: DNE
impish_golang-1.6: DNE
jammy_golang-1.6: DNE
devel_golang-1.6: DNE

Patches_golang-1.8:
upstream_golang-1.8: needs-triage
precise/esm_golang-1.8: DNE
trusty_golang-1.8: DNE
trusty/esm_golang-1.8: DNE
xenial_golang-1.8: DNE
bionic_golang-1.8: needs-triage
cosmic_golang-1.8: ignored (reached end-of-life)
disco_golang-1.8: DNE
eoan_golang-1.8: DNE
focal_golang-1.8: DNE
groovy_golang-1.8: DNE
hirsute_golang-1.8: DNE
impish_golang-1.8: DNE
jammy_golang-1.8: DNE
devel_golang-1.8: DNE

Patches_golang-1.9:
upstream_golang-1.9: needs-triage
precise/esm_golang-1.9: DNE
trusty_golang-1.9: DNE
trusty/esm_golang-1.9: DNE
xenial_golang-1.9: DNE
bionic_golang-1.9: needs-triage
cosmic_golang-1.9: ignored (reached end-of-life)
disco_golang-1.9: DNE
eoan_golang-1.9: DNE
focal_golang-1.9: DNE
groovy_golang-1.9: DNE
hirsute_golang-1.9: DNE
impish_golang-1.9: DNE
jammy_golang-1.9: DNE
devel_golang-1.9: DNE

Patches_golang-1.10:
 upstream: https://github.com/golang/go/commit/90d609ba6156299642d08afc06d85ab770a03972 (1.10.6)
 upstream: https://github.com/golang/go/commit/7ef6ee2c5727f0d11206b4d1866c18e6ab4785be (1.10.6)
upstream_golang-1.10: released (1.10.6-1)
precise/esm_golang-1.10: DNE
trusty_golang-1.10: ignored (out of standard support)
trusty/esm_golang-1.10: needed
xenial_golang-1.10: ignored (end of standard support, was needed)
esm-infra/xenial_golang-1.10: needs-triage
bionic_golang-1.10: needed
cosmic_golang-1.10: ignored (reached end-of-life)
disco_golang-1.10: ignored (reached end-of-life)
eoan_golang-1.10: DNE
focal_golang-1.10: DNE
groovy_golang-1.10: DNE
hirsute_golang-1.10: DNE
impish_golang-1.10: DNE
jammy_golang-1.10: DNE
devel_golang-1.10: DNE

Patches_golang-1.11:
 upstream: https://github.com/golang/go/commit/8954addb3294a5e664a9833354bafa58f163fe8f (1.11.3)
 upstream: https://github.com/golang/go/commit/5aedc8af94c0a8ffc58cbd09993192dea9b238db (1.11.3)
upstream_golang-1.11: released (1.11.3-1)
precise/esm_golang-1.11: DNE
trusty_golang-1.11: DNE
trusty/esm_golang-1.11: DNE
xenial_golang-1.11: DNE
bionic_golang-1.11: DNE
cosmic_golang-1.11: DNE
disco_golang-1.11: not-affected (1.11.5-1ubuntu1)
eoan_golang-1.11: DNE
focal_golang-1.11: DNE
groovy_golang-1.11: DNE
hirsute_golang-1.11: DNE
impish_golang-1.11: DNE
jammy_golang-1.11: DNE
devel_golang-1.11: DNE