CVE-2017-15041
golang: arbitrary code execution during "go get" or "go get -d"
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD, Photon OS. Rated lower by Red Hat (medium), Amazon (medium).
Description
Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 2.0 | go | 1.9.1-1.ph2 |
| amazon linux 1 | golang, golang-bin, golang-docs and 4 more | 1.8.4-1.41.amzn1 |
| amazon linux 2 | golang, golang-bin, golang-docs and 3 more | 1.9.4-1.amzn2 |
| debian 7 | golang | 2:1.0.2-1.1+deb7u2 |
| debian 8 | golang | no fix listed |
| debian 9 | golang-1.7, golang-1.8 | 1.7.4-2+deb9u3 and 1 more |
| Red Hat | golang, golang-bin, golang-pkg-bin-linux-amd64 and 2 more | no fix listed |
Show all 23 entries from 7 sources
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 2.0 | go | 1.9.1-1.ph2 |
| amazon linux 1 | golang | 1.8.4-1.41.amzn1 |
| amazon linux 1 | golang-bin | 1.8.4-1.41.amzn1 |
| amazon linux 1 | golang-docs | 1.8.4-1.41.amzn1 |
| amazon linux 1 | golang-misc | 1.8.4-1.41.amzn1 |
| amazon linux 1 | golang-race | 1.8.4-1.41.amzn1 |
| amazon linux 1 | golang-src | 1.8.4-1.41.amzn1 |
| amazon linux 1 | golang-tests | 1.8.4-1.41.amzn1 |
| amazon linux 2 | golang | 1.9.4-1.amzn2 |
| amazon linux 2 | golang-bin | 1.9.4-1.amzn2 |
| amazon linux 2 | golang-docs | 1.9.4-1.amzn2 |
| amazon linux 2 | golang-misc | 1.9.4-1.amzn2 |
| amazon linux 2 | golang-src | 1.9.4-1.amzn2 |
| amazon linux 2 | golang-tests | 1.9.4-1.amzn2 |
| debian 7 | golang | 2:1.0.2-1.1+deb7u2 |
| debian 8 | golang | no fix listed |
| debian 9 | golang-1.7 | 1.7.4-2+deb9u3 |
| debian 9 | golang-1.8 | 1.8.1-1+deb9u3 |
| Red Hat | golang | no fix listed |
| Red Hat | golang-bin | no fix listed |
| Red Hat | golang-pkg-bin-linux-amd64 | no fix listed |
| Red Hat | golang-pkg-linux-amd64 | no fix listed |
| Red Hat | golang-src | no fix listed |
References
- http://www.securityfocus.com/bid/101196
- https://access.redhat.com/errata/RHSA-2017:3463
- https://access.redhat.com/errata/RHSA-2018:0878
- https://access.redhat.com/security/cve/CVE-2017-15041
- https://github.com/golang/go/issues/22125
- https://golang.org/cl/68022
- https://golang.org/cl/68190
- https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ