CVE-2017-15041 Remote command execution via "go get" in cmd/go
CriticalCVSS 9.8
EPSS 8.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| toolchain(Go) | < 1.8.4 | 1.8.4 |
| toolchain(Go) | >= 1.9.0-0, < 1.9.1 | 1.9.1 |
| golang go | <= 1.8.3 | No fix listed |
| golang go | = 1.9 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| redhat developer tools | = 1.0 | No fix listed |
| redhat enterprise linux eus | = 7.6 | No fix listed |
| redhat enterprise linux eus | = 7.7 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.7 | No fix listed |
| redhat enterprise linux tus | = 7.6 | No fix listed |
| redhat enterprise linux tus | = 7.7 | No fix listed |
References
- go.dev patch
- go.googlesource.com patch
- go.dev issue-tracking
- groups.google.com
- 101196 third-party-advisory vdb-entry
- RHSA-2017:3463 third-party-advisory vendor-advisory
- RHSA-2018:0878 third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- golang.org issue-tracking patch vendor-advisory
- golang.org issue-tracking patch vendor-advisory
- groups.google.com mailing-list vendor-advisory
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update mailing-list third-party-advisory
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update mailing-list third-party-advisory
- GLSA-201710-23 third-party-advisory vendor-advisory