vulnwire
9.8crit

CVE-2017-15041

Remote command execution via "go get" in cmd/go

Also known as GO-2022-0177

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
8.9%
percentile 95%
Public exploits
0
none known

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

Exploit prediction (EPSS)

8.94% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

EcosystemPackageAffectedFixed in
gotoolchain
<1.8.4
>=1.9.0-0, <1.9.1
1.8.4
1.9.1

References

  • access.redhat.com /errata/RHSA-2017:3463 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:0878 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • golang.org /cl/68190 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/101196 · vdb-entry, x_refsource_BID, x_transferred
  • golang.org /cl/68022 · x_refsource_CONFIRM, x_transferred
  • security.gentoo.org /glsa/201710-23 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • groups.google.com /d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ · x_refsource_CONFIRM, x_transferred
  • github.com /golang/go/issues/22125 · x_refsource_CONFIRM, x_transferred
  • lists.debian.org /debian-lts-announce/2021/03/msg00014.html · mailing-list, x_refsource_MLIST, x_transferred
  • lists.debian.org /debian-lts-announce/2021/03/msg00015.html · mailing-list, x_refsource_MLIST, x_transferred
  • go.dev /cl/68110 · fix
  • go.googlesource.com /go/+/ec71ee078fd3243b78c0d404c8634bd97e38d7eb · fix
  • go.dev /issue/22125 · report
  • groups.google.com /g/golang-dev/c/RinSE3EiJBI/m/kYL7zb07AgAJ · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.