Skip to content
OpenAdvisories
Unscored CVE-2017-15041 EUVD-2017-6516GHSA-2w49-qg9p-7jxxGO-2022-0177

Remote command execution via "go get" in cmd/go

Published Oct 5, 2017 · Updated Aug 5, 2024 · Assigned by mitre

Package: golang-1.6 Package: golang-1.8 Package: toolchain Ecosystem: Go Ecosystem: Ubuntu

Description

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 9 golang-1.7 1.7.4-2+deb9u3 DLA-2591-1
Debian 9 golang-1.8 1.8.1-1+deb9u3 DLA-2592-1
Debian 7 golang 2:1.0.2-1.1+deb7u2 DLA-1148-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS golang-1.8 No fix yet —
Ubuntu 16.04 LTS golang-1.6 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 golang +5 1.9.4-1.el7 RHSA-2018:0878
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Devtools 2 go-toolset-7 +4 1.8-10.el7 RHSA-2017:3463
Red Hat Devtools 2 go-toolset-7-golang +6 1.8.5-1.el7 RHSA-2017:3463

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go 1.17-1.1 openSUSE-SU-2024:10802-1
openSUSE Tumbleweed go1.10 1.10.8-8.2 openSUSE-SU-2024:10803-1
openSUSE Tumbleweed go1.11 1.11.13-10.5 openSUSE-SU-2024:10804-1
openSUSE Tumbleweed go1.12 1.12.17-4.8 openSUSE-SU-2024:10805-1
openSUSE Tumbleweed go1.4 1.4.3-12.2 openSUSE-SU-2024:10811-1
openSUSE Tumbleweed go1.9 1.9.7-11.2 openSUSE-SU-2024:10812-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 golang +5 1.9.4-1.amzn2 ALAS2-2018-1011

Affected packages

EcosystemPackageAffectedFixedRecord
Go toolchain < 1.8.4 · >= 1.9.0-0, < 1.9.1 1.8.4, 1.9.1 GO-2022-0177

Advisories 12

References