Vulnerability in N/a
CVE-2018-7187
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS com…
EPSS: 0.637 (99.1th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- [debian-lts-announce] 20180225 [SECURITY] [DLA 1294-1] golang security update (mailing-list, x_refsource_MLIST)
- DSA-4380 (vendor-advisory, x_refsource_DEBIAN)
- GLSA-201804-12 (vendor-advisory, x_refsource_GENTOO)
- DSA-4379 (vendor-advisory, x_refsource_DEBIAN)
- github.com/golang/go/issues/23867 (x_refsource_CONFIRM)
- gist.github.com/SLAYEROWNER/b2a358f13ab267f2e9543bb9f9320ffc (x_refsource_MISC)
Frequently asked questions
- What is CVE-2018-7187?
- CVE-2018-7187 is a vulnerability in N/a. Published 2018-02-16.
- Is CVE-2018-7187 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.