| id: GO-2022-0203 |
| modules: |
| - module: cmd |
| versions: |
| - fixed: 1.9.5 |
| - introduced: 1.10.0-0 |
| fixed: 1.10.1 |
| vulnerable_at: 1.10.0 |
| packages: |
| - package: cmd/go |
| skip_fix: 'TODO: revisit this reason (cant request explicit version of standard library package cmd/go)' |
| summary: Remote command execution via "go get" command with "-insecure" option in cmd/go |
| description: |- |
| The "go get" command is vulnerable to remote code execution. |
| |
| When the -insecure command-line option is used, "go get" does not validate the |
| import path (get/vcs.go only checks for "://" anywhere in the string), which |
| allows remote attackers to execute arbitrary OS commands via a crafted web site. |
| published: 2022-08-09T23:19:00Z |
| cves: |
| - CVE-2018-7187 |
| credits: |
| - Arthur Khashaev |
| references: |
| - fix: https://go.dev/cl/94603 |
| - fix: https://go.googlesource.com/go/+/c941e27e70c3e06e1011d2dd71d72a7a06a9bcbc |
| - report: https://go.dev/issue/23867 |
| - web: https://groups.google.com/g/golang-announce/c/IkPkOF8JqLs/m/TFBbWHJYAwAJ |
