CVE-2017-15041

9 documents6 sources
Severity
9.8CRITICAL
EPSS
4.1%
top 11.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Golang GODebian Debian LinuxRedhat Developer Tools+4 more
Timeline
PublishedOct 5
Latest updateAug 9

Description

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversi…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶Gotoolchain1.9.0-0 — 1.9.1+1
▶NVDgolang/go1.8.3+1

Also affects: Debian Linux 9.0, Enterprise Linux 7.6, 7.7

Patches

Patch: github.com ↗Patch: golang.org ↗Patch: golang.org ↗

🔴Vulnerability Details

4
OSV
Remote command execution via "go get" in cmd/go↗2022-08-09
▶
GHSA
GHSA-2w49-qg9p-7jxx: Go before 1↗2022-05-13
▶
OSV
CVE-2017-15041: Go before 1↗2017-10-05
▶
CVEList
CVE-2017-15041: Go before 1↗2017-10-05
▶

📋Vendor Advisories

1
Red Hat
golang: arbitrary code execution during "go get" or "go get -d"↗2017-10-04
▶

💬Community

3
Bugzilla
CVE-2017-15041 CVE-2017-15042 golang: various flaws [fedora-all]↗2017-10-05
▶
Bugzilla
CVE-2017-15041 golang: arbitrary code execution during "go get" or "go get -d"↗2017-10-05
▶
Bugzilla
CVE-2017-15041 CVE-2017-15042 golang: various flaws [epel-6]↗2017-10-05
▶