CVE-2018-7187
CVE-2018-7187
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
CVSS 8.8 · High · EPSS 63.0%
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
golang-1.6 Ubuntu:16.04:LTS
- Versions
- 1.6-0ubuntu1
- 1.6-0ubuntu2
- 1.6-0ubuntu3
- 1.6-0ubuntu4
- 1.6-0ubuntu5
- 1.6.1-0ubuntu1
- 1.6.2-0ubuntu5~16.04
- 1.6.2-0ubuntu5~16.04.2
- 1.6.2-0ubuntu5~16.04.3
- 1.6.2-0ubuntu5~16.04.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.9 Ubuntu:18.04:LTS
- Versions
- 1.9.1-2ubuntu1
- 1.9.2-1ubuntu1
- 1.9.2-3ubuntu1
- 1.9.3-1ubuntu1
- 1.9.4-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://lists.debian.org/debian-lts-announce/2018/02/msg00029.html
- https://www.debian.org/security/2019/dsa-4380
- https://security.gentoo.org/glsa/201804-12
- https://www.debian.org/security/2019/dsa-4379
- https://github.com/golang/go/issues/23867
- https://gist.github.com/SLAYEROWNER/b2a358f13ab267f2e9543bb9f9320ffc
- https://nvd.nist.gov/vuln/detail/CVE-2018-7187