cmd/go: directory traversal in "go get" via curly braces in import paths #29231
Labels
Milestone
Comments
This was referenced Dec 13, 2018
dmitshur
changed the title
thaJeztah
added a commit
to thaJeztah/docker
that referenced
this issue
Dec 13, 2018
go1.10.6 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.10.6 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.10.6 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/docker
that referenced
this issue
Dec 13, 2018
go1.11.13 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
|
Change https://golang.org/cl/154101 mentions this issue: |
|
Change https://golang.org/cl/154103 mentions this issue: |
thaJeztah
added a commit
to thaJeztah/golang-cross
that referenced
this issue
Dec 13, 2018
go1.11.13 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/golang-cross
that referenced
this issue
Dec 14, 2018
go1.10.6 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.10.6 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.10.6 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/cli
that referenced
this issue
Dec 14, 2018
go1.10.6 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.10.6 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.10.6 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/cli
that referenced
this issue
Dec 14, 2018
go1.10.6 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.10.6 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.10.6 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
gopherbot
pushed a commit
that referenced
this issue
Dec 14, 2018
This should be a no-op, but produces deterministic (and more correct) behavior if we have accidentally failed to sanitize one of the inputs. Updates #29231 Change-Id: I1271d0ffd01a691ec8c84906c4e02d9e2be19c72 Reviewed-on: https://team-review.git.corp.google.com/c/370575 Reviewed-by: Russ Cox <rsc@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-on: https://go-review.googlesource.com/c/154103 Reviewed-by: Bryan C. Mills <bcmills@google.com>
thaJeztah
added a commit
to thaJeztah/docker-ce-packaging
that referenced
this issue
Dec 14, 2018
go1.11.13 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/docker-ce-packaging
that referenced
this issue
Dec 14, 2018
go1.11.3 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/docker-ce-packaging
that referenced
this issue
Dec 14, 2018
go1.11.3 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
docker-jenkins
pushed a commit
to docker/docker-ce
that referenced
this issue
Dec 15, 2018
go1.10.6 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.10.6 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.10.6 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> Upstream-commit: 8afe9f422dc0183ce48e1db09189ccbde634080a Component: engine
docker-jenkins
pushed a commit
to docker/docker-ce
that referenced
this issue
Dec 15, 2018
go1.10.6 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.10.6 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.10.6 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> Upstream-commit: 6c3a10aaede0cfc54cb5befbb70d6357d08d75b7 Component: cli
docker-jenkins
pushed a commit
to docker/docker-ce
that referenced
this issue
Dec 17, 2018
go1.11.3 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> Upstream-commit: 517a30b Component: packaging
thaJeztah
added a commit
to thaJeztah/cli
that referenced
this issue
Dec 19, 2018
go1.11.4 (released 2018/12/14) includes fixes to cgo, the compiler, linker, runtime, documentation, go command, and the net/http and go/types packages. It includes a fix to a bug introduced in Go 1.11.3 that broke go get for import path patterns containing "...". See the Go 1.11.4 milestone for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.4+label%3ACherryPickApproved go1.11.3 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
docker-jenkins
pushed a commit
to docker/docker-ce
that referenced
this issue
Dec 19, 2018
go1.11.13 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> Upstream-commit: 6b7c093b0de21d574ce120aee891e60187749174 Component: engine
docker-jenkins
pushed a commit
to docker/docker-ce
that referenced
this issue
Jan 8, 2019
go1.11.4 (released 2018/12/14) includes fixes to cgo, the compiler, linker, runtime, documentation, go command, and the net/http and go/types packages. It includes a fix to a bug introduced in Go 1.11.3 that broke go get for import path patterns containing "...". See the Go 1.11.4 milestone for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.4+label%3ACherryPickApproved go1.11.3 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> Upstream-commit: deaf6e13ab067e6794d20ec980b4ae216b65d07c Component: cli
thaJeztah
added a commit
to thaJeztah/cli
that referenced
this issue
Mar 4, 2019
go1.11.4 (released 2018/12/14) includes fixes to cgo, the compiler, linker, runtime, documentation, go command, and the net/http and go/types packages. It includes a fix to a bug introduced in Go 1.11.3 that broke go get for import path patterns containing "...". See the Go 1.11.4 milestone for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.4+label%3ACherryPickApproved go1.11.3 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit deaf6e1) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/cli
that referenced
this issue
Mar 28, 2019
go1.11.4 (released 2018/12/14) includes fixes to cgo, the compiler, linker, runtime, documentation, go command, and the net/http and go/types packages. It includes a fix to a bug introduced in Go 1.11.3 that broke go get for import path patterns containing "...". See the Go 1.11.4 milestone for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.4+label%3ACherryPickApproved go1.11.3 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit deaf6e1) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/cli
that referenced
this issue
Mar 28, 2019
go1.11.4 (released 2018/12/14) includes fixes to cgo, the compiler, linker, runtime, documentation, go command, and the net/http and go/types packages. It includes a fix to a bug introduced in Go 1.11.3 that broke go get for import path patterns containing "...". See the Go 1.11.4 milestone for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.4+label%3ACherryPickApproved go1.11.3 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit deaf6e1) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
adhulipa
pushed a commit
to adhulipa/docker
that referenced
this issue
Apr 11, 2019
go1.11.13 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/cli
that referenced
this issue
Apr 14, 2019
go1.11.4 (released 2018/12/14) includes fixes to cgo, the compiler, linker, runtime, documentation, go command, and the net/http and go/types packages. It includes a fix to a bug introduced in Go 1.11.3 that broke go get for import path patterns containing "...". See the Go 1.11.4 milestone for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.4+label%3ACherryPickApproved go1.11.3 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit deaf6e1) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/cli
that referenced
this issue
May 20, 2019
go1.11.4 (released 2018/12/14) includes fixes to cgo, the compiler, linker, runtime, documentation, go command, and the net/http and go/types packages. It includes a fix to a bug introduced in Go 1.11.3 that broke go get for import path patterns containing "...". See the Go 1.11.4 milestone for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.4+label%3ACherryPickApproved go1.11.3 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit deaf6e1) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/cli
that referenced
this issue
Jun 14, 2019
go1.11.4 (released 2018/12/14) includes fixes to cgo, the compiler, linker, runtime, documentation, go command, and the net/http and go/types packages. It includes a fix to a bug introduced in Go 1.11.3 that broke go get for import path patterns containing "...". See the Go 1.11.4 milestone for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.4+label%3ACherryPickApproved go1.11.3 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit deaf6e1) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/docker
that referenced
this issue
Jun 20, 2019
go1.11.13 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 6b7c093) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/docker-ce-packaging
that referenced
this issue
Jul 8, 2019
go1.11.3 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 517a30b) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
docker-jenkins
pushed a commit
to docker/docker-ce
that referenced
this issue
Jul 24, 2019
go1.11.4 (released 2018/12/14) includes fixes to cgo, the compiler, linker, runtime, documentation, go command, and the net/http and go/types packages. It includes a fix to a bug introduced in Go 1.11.3 that broke go get for import path patterns containing "...". See the Go 1.11.4 milestone for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.4+label%3ACherryPickApproved go1.11.3 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit deaf6e13ab067e6794d20ec980b4ae216b65d07c) Signed-off-by: Sebastiaan van Stijn <github@gone.nl> Upstream-commit: a378a009541cf2377e6410c28183d7710ad37ed6 Component: cli
docker-jenkins
pushed a commit
to docker/docker-ce
that referenced
this issue
Jul 24, 2019
go1.11.13 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 6b7c093b0de21d574ce120aee891e60187749174) Signed-off-by: Sebastiaan van Stijn <github@gone.nl> Upstream-commit: 19d37c9a337e82e0e8ce0ff28271739e8ec78e83 Component: engine
docker-jenkins
pushed a commit
to docker/docker-ce
that referenced
this issue
Aug 7, 2019
go1.11.3 (released 2018/12/14) - crypto/x509: CPU denial of service in chain validation golang/go#29233 - cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231 - cmd/go: remote command execution during "go get -u" golang/go#29230 See the Go 1.11.3 milestone on the issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.11.3 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 517a30b) Signed-off-by: Sebastiaan van Stijn <github@gone.nl> Upstream-commit: 17565b93d361b1b189962b3e98c431316a7cc628 Component: packaging
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
go getdownloads and builds source code. It is not supposed to allow arbitrary filesystem writes.The
go getcommand is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both{and}characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.Thanks to ztz of Tencent Security Platform for discovering and reporting this issue.
This issue is CVE-2018-16874.
The text was updated successfully, but these errors were encountered: