CVE-2018-6574 Amazon Linux Security Advisory for golang: ALAS-2018-975

Arbitrary code execution during go get via C compiler options: An arbitrary command execution flaw was found in the way Go s go get command handled gcc and clang sensitive options during the build. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side. (CVE-2018-6574 )

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.

Please refer to Amazon advisory ALAS-2018-974 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ALAS-2018-974: Amazon Linux (java-1.7.0-openjdk (1.7.0.171-2.6.13.0.76.amzn1) on noarch)

ALAS-2018-974: Amazon Linux (java-1.7.0-openjdk (1.7.0.171-2.6.13.0.76.amzn1) on x86_64)

ALAS-2018-974: Amazon Linux (java-1.7.0-openjdk (1.7.0.171-2.6.13.0.76.amzn1) on src)

ALAS-2018-974: Amazon Linux (java-1.7.0-openjdk (1.7.0.171-2.6.13.0.76.amzn1) on i686)