Advisories » MGASA-2018-0144

Updated golang packages fix security vulnerability

Publication date: 26 Feb 2018
Modification date: 26 Feb 2018
Type: security
Affected Mageia releases : 6
CVE: CVE-2018-6574

Description

Updated golang packages fix security vulnerabilities:

Go before 1.9.4 allows "go get" remote command execution during source code
build, by leveraging the gcc or clang plugin feature, because -fplugin= and
-plugin= arguments were not blocked (CVE-2018-6574).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=22646
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/C4TOPVSIULS5EMGKZ6OHC6LNDR7QA7W3/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6574

SRPMS

6/core

• golang-1.9.4-3.mga6