| modules: |
| - module: cmd |
| versions: |
| - fixed: 1.9.5 |
| - introduced: 1.10.0 |
| fixed: 1.10.1 |
| vulnerable_at: 1.10.0 |
| packages: |
| - package: cmd/go |
| description: | |
| The "go get" command is vulnerable to remote code execution. |
| |
| When the -insecure command-line option is used, "go get" does not validate |
| the import path (get/vcs.go only checks for "://" anywhere in the string), |
| which allows remote attackers to execute arbitrary OS commands via a |
| crafted web site. |
| published: 2022-08-09T23:19:00Z |
| cves: |
| - CVE-2018-7187 |
| credit: Arthur Khashaev |
| references: |
| - fix: https://go.dev/cl/94603 |
| - fix: https://go.googlesource.com/go/+/c941e27e70c3e06e1011d2dd71d72a7a06a9bcbc |
| - report: https://go.dev/issue/23867 |
| - web: https://groups.google.com/g/golang-announce/c/IkPkOF8JqLs/m/TFBbWHJYAwAJ |
