Command injection in Go programming language - CVE-2017-15041

Vulnerability identifier: #VU12160

CSH Severity: Low

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-15041

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The weakness exists due to "go get" command execution. Using custom domains, a remote attacker can arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

Go programming language
Arch Linux
Gentoo Linux
Amazon Linux AMI
Fedora
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power
go (Alpine package)
golang
go-toolset-7-golang (Red Hat package)
go-toolset-7 (Red Hat package)

Update to versions 1.8.4 or 1.9.1.

go (Alpine package) - update to 1.8.4-r0
golang - addressed in versions 1.7.6-2.el6, 1.7.6-3.fc25, 1.8.4-1.fc26, 1.9.1-1.fc27
go-toolset-7-golang (Red Hat package) - update to 1.8.5-1.el7
go-toolset-7 (Red Hat package) - update to 1.8-10.el7

• https://go-review.googlesource.com/c/go/+/68022

• Arch Linux update for go
• Arch Linux update for go-pie
• Gentoo update for Go
• Amazon Linux AMI update for golang
• Red Hat update for golang
• Command injection in go (Alpine package)
• Fedora 26 update for golang
• Fedora 27 update for golang
• Fedora 25 update for golang
• Fedora EPEL 6 update for golang
• Red Hat Developer Tools update for go-toolset-7 and go-toolset-7-golang