CVE - CVE-2017-15041

CVE-ID
CVE-2017-15041	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:101196 URL:http://www.securityfocus.com/bid/101196 CONFIRM:https://github.com/golang/go/issues/22125 CONFIRM:https://golang.org/cl/68022 CONFIRM:https://golang.org/cl/68190 CONFIRM:https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ GENTOO:GLSA-201710-23 URL:https://security.gentoo.org/glsa/201710-23 MLIST:[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update URL:https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html MLIST:[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update URL:https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html REDHAT:RHSA-2017:3463 URL:https://access.redhat.com/errata/RHSA-2017:3463 REDHAT:RHSA-2018:0878 URL:https://access.redhat.com/errata/RHSA-2018:0878
Assigning CNA
MITRE Corporation
Date Record Created
20171005	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20171005)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is a record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)