Skip to content
OpenAdvisories
Unscored DLA-1294-1 1 CVE

golang - security update

Published Feb 25, 2018 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 7 golang 2:1.0.2-1.1+deb7u3

Vulnerabilities 1

  • Unscored —
    CVE-2018-7187 EPSS 63%

    Remote command execution via "go get" command with "-insecure" option in cmd/go

    The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted …

    golang-1.6 golang-1.9 toolchain Ubuntu Go