CVE-2018-7187: OS Command Injection
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7187?
CVE-2018-7187 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2018-7187?
To mitigate CVE-2018-7187, it is recommended to upgrade Go to version 1.9.5 or later where this vulnerability has been patched.
What types of attacks does CVE-2018-7187 allow?
CVE-2018-7187 allows attackers to execute arbitrary OS commands via a crafted web address when using the 'go get' command with the -insecure option.
Which versions of Go are affected by CVE-2018-7187?
CVE-2018-7187 affects Go versions prior to 1.9.5 and also certain versions in the 1.10 series up to 1.10.1.
What is the impact of CVE-2018-7187 on systems using Go?
The impact of CVE-2018-7187 includes the potential for unauthorized remote command execution, which could compromise the security of affected systems.