NetSight
IP …
high8.8

CVE-2018-7187

The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" an…

Impact

The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.

Affected products

VendorProductAffected versions
GolangGo
before 1.9.5
from 1.10 before 1.10.1
DebianDebian Linux
Versions 7.0, 9.0

Weakness classification

CWE-78

References