CVE-2017-15041
Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so…
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 8.9% · top 4.7% of all CVEs (3 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
- n/a
Affected products
n/a
- affected n/a
References (10)
- RHSA-2017:3463 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2018:0878 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- https://golang.org/cl/68190 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 101196 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- https://golang.org/cl/68022 (opens in a new tab)x_refsource_CONFIRMx_transferred
- GLSA-201710-23 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
- https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/golang/go/issues/22125 (opens in a new tab)x_refsource_CONFIRMx_transferred
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2017-15041)Record last updated .