Description
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | golang-1.7 | 1.7.4-2+deb9u1 | DSA-4379-1 |
| Debian 9 | golang-1.8 | 1.8.1-1+deb9u1 | DSA-4380-1 |
| Debian 7 | golang | 2:1.0.2-1.1+deb7u3 | DLA-1294-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | golang-1.9 | No fix yet | — |
| Ubuntu 16.04 LTS | golang-1.6 | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | containerd | 1.1.2-5.3.4 | SUSE-SU-2018:4297-1 |
| SLES 15 | docker | 18.06.1_ce-6.8.2 | SUSE-SU-2018:4297-1 |
| SLES 15 | docker-runc | 1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4 | SUSE-SU-2018:4297-1 |
| SLES 15 | golang-github-docker-libnetwork | 0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5 | SUSE-SU-2018:4297-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 | go | 1.10.4-bp150.2.3.1 | openSUSE-SU-2018:4302-1 |
| SUSE Package Hub 15 | go1.10 | 1.10.7-bp150.2.1 | openSUSE-SU-2018:4302-1 |
| SUSE Package Hub 15 | golang-packaging | 15.0.11-bp150.3.3.1 | openSUSE-SU-2018:4302-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go | 1.17-1.1 | openSUSE-SU-2024:10802-1 |
| openSUSE Tumbleweed | go1.9 | 1.9.7-11.2 | openSUSE-SU-2024:10812-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | toolchain | < 1.9.5 · >= 1.10.0-0, < 1.10.1 | 1.9.5, 1.10.1 | GO-2022-0203 |
Advisories 7
- DSA-4379-1 golang-1.7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4380-1 golang-1.8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1294-1 golang - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2018:4297-1 Security update for containerd, docker and go SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10812-1 go1.9-1.9.7-11.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2018:4302-1 Security update for go SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10802-1 go-1.17-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- [debian-lts-announce] 20180225 [SECURITY] [DLA 1294-1] golang security update mailing-list
- DSA-4380 vendor-advisory
- GLSA-201804-12 vendor-advisory
- DSA-4379 vendor-advisory
- https://github.com/golang/go/issues/23867
- https://gist.github.com/SLAYEROWNER/b2a358f13ab267f2e9543bb9f9320ffc