Skip to content
OpenAdvisories
Unscored DLA-1148-1 1 CVE

golang - security update

Published Oct 27, 2017 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 7 golang 2:1.0.2-1.1+deb7u2

Vulnerabilities 1

  • Unscored —
    CVE-2017-15041

    Remote command execution via "go get" in cmd/go

    Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Sub…

    golang-1.8 golang-1.6 toolchain Ubuntu Go