--- title: "CVE-2018-16873\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2018-16873?format=md keywords: index, follow --- # CVE-2018-16873 Publication date 14 December 2018 Last updated 26 August 2025 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **7.5 · High** [Score breakdown](https://ubuntu.com/security/CVE-2018-16873?format=md#impact-score) Toggle side navigation ## Description In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module\_aware\_go\_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u". [Read the notes from the security team](https://ubuntu.com/security/CVE-2018-16873?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | golang | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Not in release | | 20.04 LTS focal | Not in release | | 19.10 eoan | Not in release | | 19.04 disco | Not in release | | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | golang-1.10 | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Not in release | | 20.04 LTS focal | Not in release | | 19.10 eoan | Not in release | | 19.04 disco | Ignored end of life | | 18.10 cosmic | Ignored end of life | | 18.04 LTS bionic | Vulnerable | | 16.04 LTS xenial | Needs evaluation | | 14.04 LTS trusty | Vulnerable | | golang-1.11 | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Not in release | | 20.04 LTS focal | Not in release | | 19.10 eoan | Not in release | | 19.04 disco | Not affected | | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | golang-1.6 | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Not in release | | 20.04 LTS focal | Not in release | | 19.10 eoan | Not in release | | 19.04 disco | Not in release | | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Needs evaluation | | 14.04 LTS trusty | Not in release | | golang-1.8 | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Not in release | | 20.04 LTS focal | Not in release | | 19.10 eoan | Not in release | | 19.04 disco | Not in release | | 18.10 cosmic | Ignored end of life | | 18.04 LTS bionic | Needs evaluation | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | golang-1.9 | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Not in release | | 20.04 LTS focal | Not in release | | 19.10 eoan | Not in release | | 19.04 disco | Not in release | | 18.10 cosmic | Ignored end of life | | 18.04 LTS bionic | Needs evaluation | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) * [Patch details](https://ubuntu.com/security/CVE-2018-16873?format=md#patch-details) ## Notes --- ### [mdeslaur](https://launchpad.net/~mdeslaur) Packages built using golang need to be rebuilt once the vulnerability has been fixed. This CVE entry does not list packages that need rebuilding outside of the main repository or the Ubuntu variants with PPA overlays. ### Patch details For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) | Package | Patch details | | --- | --- | | golang-1.10 | * Upstream: [90d609b](https://github.com/golang/go/commit/90d609ba6156299642d08afc06d85ab770a03972) * Upstream: [7ef6ee2](https://github.com/golang/go/commit/7ef6ee2c5727f0d11206b4d1866c18e6ab4785be) | | golang-1.11 | * Upstream: [8954add](https://github.com/golang/go/commit/8954addb3294a5e664a9833354bafa58f163fe8f) * Upstream: [5aedc8a](https://github.com/golang/go/commit/5aedc8af94c0a8ffc58cbd09993192dea9b238db) | ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 7.5 · High * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | High | | Privileges required | None | | User interaction | Required | | Scope | Unchanged | | Confidentiality impact | High | | Integrity impact | High | | Availability impact | High | * Scores | Parameter | Value | | --- | --- | | Base score | 7.5 · High | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16873) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-16873) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2018-16873) * [Debian](https://security-tracker.debian.org/tracker/CVE-2018-16873) ### Other references * *