9.8

CVE-2017-15041

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

Data is provided by the National Vulnerability Database (NVD)
Golang ≫ Go Version <= 1.8.3
Golang ≫ Go Version1.9 Update-
Debian ≫ Debian Linux Version9.0
Redhat ≫ Developer Tools Version1.0
Redhat ≫ Enterprise Linux Eus Version7.6
Redhat ≫ Enterprise Linux Eus Version7.7
Redhat ≫ Enterprise Linux Tus Version7.6
Redhat ≫ Enterprise Linux Tus Version7.7
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 6.02% 0.902
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
http://www.securityfocus.com/bid/101196
Third Party Advisory
VDB Entry
https://github.com/golang/go/issues/22125
Patch
Third Party Advisory
Issue Tracking
https://golang.org/cl/68022
Patch
Vendor Advisory
Issue Tracking
https://golang.org/cl/68190
Patch
Vendor Advisory
Issue Tracking