MGASA-2018-0089

Dashboard / Vulnerabilities / MGASA-2018-0089

MGASA-2018-0089

Summary: Updated golang packages fix security vulnerabilities

Details: An arbitrary command execution flaw was found in the way Go's "go get" command handled the checkout of source code repositories. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side (CVE-2017-15041). It was found that smtp.PlainAuth authentication scheme in Go did not verify the TLS requirement properly. A remote man-in-the-middle attacker could potentially use this flaw to sniff SMTP credentials sent by a Go application (CVE-2017-15042).

References: https://advisories.mageia.org/MGASA-2018-0089.html, https://bugs.mageia.org/show_bug.cgi?id=21857, https://lists.fedoraproject.org/archives/list/[email protected]/thread/AHH5B4WHCPTVEM6APRVXRWLFOR325CCD/