Software Update: Go 1.9.4 / 1.8.7 / 1.10rc2

Go, also referred to as golang, is a programming language developed by Google and the open source community since 2007. Among other things, the language is cloudflare, google, Netflix and Uber used. Go code can be compiled for Android, Linux, macOS, FreeBSD, and Windows on i386, amd64, and ARM processor architectures. The syntax of Go is similar to that of C and similar programming languages, although there are also some notable differences. Go also offers the option of distributed programming, in which several processes are executed simultaneously. The team has released Go versions 1.9.4, 1.8.7 and 1.10rc2 with the following announcement:

Go 1.8.7, Go 1.9.4, and Go 1.10rc2 are released

We have just released Go 1.8.7, Go 1.9.4, and Go 1.10rc2, to address a recently-reported security issue. We recommend that all users update to one of these releases (if you’re not sure which, choose Go 1.9.4).

By using the clang or gcc plugin mechanism, it was possible for an attacker to trick the “go get” command into executing arbitrary code. The go command now restricts the set of allowed host compiler and linker arguments in cgo source files to a list of allowed flags, in particular disallowing -fplugin= and -plugin=.

The issue is CVE-2018-6574 and Go issue golang.org/issue/23672. See the Go issue for details.

Thanks to Christopher Brown of Mattermost for reporting this problem.

Downloads are available at for all supported platforms.