Total vulnerabilities in the database
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
| Software | From | Fixed in |
|---|---|---|
| golang / go | 1.11.0 | 1.11.3 |
| golang / go | - | 1.10.6 |
| opensuse / leap | 42.3 | 42.3.x |
| opensuse / leap | 15.0 | 15.0.x |
| opensuse / leap | 15.1 | 15.1.x |
| suse / linux_enterprise_server | 12 | 12.x |
| opensuse / backports_sle | 15.0 | 15.0.x |
| debian / debian_linux | 9.0 | 9.0.x |