66aa33f03a
By using the clang or gcc plugin mechanism, it was possible for an attacker to trick the “go get” command into executing arbitrary code. The go command now restricts the set of allowed host compiler and linker arguments in cgo source files to a list of allowed flags, in particular disallowing -fplugin= and -plugin=. The issue is CVE-2018-6574 and Go issue golang.org/issue/23672. See the Go issue for details. Thanks to Christopher Brown of Mattermost for reporting this problem. |
||
|---|---|---|
| .. | ||
| patches | ||
| DESCR | ||
| distinfo | ||
| go-package.mk | ||
| Makefile | ||
| PLIST | ||
| PLIST.Linux | ||
| PLIST.SunOS | ||
| version.mk | ||