CVE-2018-6574: Debian Linux

High severity, CVSS 7.8. EPSS: 7.6% chance of exploitation in the next 30 days.

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Affected products

• Debian Debian Linux: version 9.0 only
• Golang Go: up to and including 1.8.6; version 1.9 only; version 1.9.1 only; version 1.9.2 only; version 1.9.3 only; version 1.10 only
• Red Hat Enterprise Linux Server: version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.6 only
• Red Hat Enterprise Linux Server Eus: version 7.6 only
• Red Hat Enterprise Linux Server Tus: version 7.6 only

Published 2018-02-07. Last modified 2026-06-17.