{
  "id": "GO-2022-0201",
  "published": "2022-08-09T18:15:41Z",
  "modified": "0001-01-01T00:00:00Z",
  "aliases": [
    "CVE-2018-6574"
  ],
  "details": "The \"go get\" command with cgo is vulnerable to remote command execution\nby leveraging the gcc or clang plugin feature.\n\nWhen cgo is enabled, the build step during \"go get\" invokes the host C\ncompiler, gcc or clang, adding compiler flags specified in the Go source\nfiles. Both gcc and clang support a plugin mechanism in which a\nshared-library plugin is loaded into the compiler, as directed by\ncompiler flags. This means that a Go package repository can contain an\nattack.so file along with a Go source file that says (for example)\n\"// #cgo CFLAGS: -fplugin=attack.so\" causing the attack plugin to be\nloaded into the host C compiler during the build. Gcc and clang plugins are\ncompletely unrestricted in their access to the host system.\n",
  "affected": [
    {
      "package": {
        "name": "toolchain",
        "ecosystem": "Go"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.7"
            },
            {
              "introduced": "1.9.0"
            },
            {
              "fixed": "1.9.4"
            }
          ]
        }
      ],
      "database_specific": {
        "url": "https://pkg.go.dev/vuln/GO-2022-0201"
      },
      "ecosystem_specific": {
        "imports": [
          {
            "path": "cmd/go"
          }
        ]
      }
    }
  ],
  "references": [
    {
      "type": "FIX",
      "url": "https://go.googlesource.com/go/+/1dcb5836ad2c60776561da2923c70576ba2eefc6"
    },
    {
      "type": "REPORT",
      "url": "https://go.dev/issue/23672"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/golang-nuts/c/Gbhh1NxAjMU"
    }
  ]
}