QwikSec

Security Database

CVE

CWE

Training

CVE-2018-7187

Published: Feb 16, 2018

Modified: Aug 5, 2024

PUBLISHED

Description

The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

[debian-lts-announce] 20180225 [SECURITY] [DLA 1294-1] golang security update

mailing-list

x_refsource_MLIST

vendor-advisory

x_refsource_DEBIAN

vendor-advisory

x_refsource_GENTOO

vendor-advisory

x_refsource_DEBIAN

https://github.com/golang/go/issues/23867

x_refsource_CONFIRM

https://gist.github.com/SLAYEROWNER/b2a358f13ab267f2e9543bb9f9320ffc

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.