Every CVE Search/ Get API key

CVE-2017-15041

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom...

9.8 CriticalFix available

CVE-2017-15041 is a critical vulnerability (CVSS 9.8) in Golang Go, published October 5, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.94%, the 95th percentile. Fixed in golang 2:1.0.2-1.1+deb7u2.

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

8.94%Up 4.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

Record
CVE-2017-15041
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

Record
CVE-2017-15041
Updated
2026-11-02
EUVDEUVD-2017-6516 No score

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

Record
EUVD-2017-6516
Updated
2026-11-03
GitHub AdvisoriesGHSA-2w49-qg9p-7jxx 9.8

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom...

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

Record
GHSA-2w49-qg9p-7jxx
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

Record
CVE-2017-15041
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2017:3463 7.5

Red Hat Security Advisory: go-toolset-7 and go-toolset-7-golang security and bug fix update

Record
RHSA-2017:3463
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVRHSA-2018:0878 7.5

Red Hat Security Advisory: golang security, bug fix, and enhancement update

Record
RHSA-2018:0878
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-15041 9.8

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

Record
UBUNTU-CVE-2017-15041
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGO-2022-0177 No score

Remote command execution via "go get" in cmd/go

The "go get" command allows remote command execution.

Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get".

Record
GO-2022-0177
Updated
2026-11-02
OSVMGASA-2018-0089 No score

Updated golang packages fix security vulnerabilities

An arbitrary command execution flaw was found in the way Go's "go get" command handled the checkout of source code repositories. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side (CVE-2017-15041).

It was found that smtp.PlainAuth authentication scheme in Go did not verify the TLS requirement properly. A remote man-in-the-middle attacker could potentially use this flaw to sniff SMTP credentials sent by a Go application (CVE-2017-15042).

Record
MGASA-2018-0089
Updated
2026-11-02
OSVopenSUSE-SU-2024:10802-1 No score

go-1.17-1.1 on GA media

These are all security issues fixed in the go-1.17-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10802-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10803-1 No score

go1.10-1.10.8-8.2 on GA media

These are all security issues fixed in the go1.10-1.10.8-8.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10803-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10804-1 No score

go1.11-1.11.13-10.5 on GA media

These are all security issues fixed in the go1.11-1.11.13-10.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10804-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10805-1 No score

go1.12-1.12.17-4.8 on GA media

These are all security issues fixed in the go1.12-1.12.17-4.8 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10805-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10811-1 No score

go1.4-1.4.3-12.2 on GA media

These are all security issues fixed in the go1.4-1.4.3-12.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10811-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10812-1 No score

go1.9-1.9.7-11.2 on GA media

These are all security issues fixed in the go1.9-1.9.7-11.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10812-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
golang
Debian:7
 before 2:1.0.2-1.1+deb7u2, plus listed versions
2:1.0.2-1.12:1.0.2-1.1+deb7u1
2:1.0.2-1.1+deb7u2
golang-1.7
Debian:9
 before 1.7.4-2+deb9u3, plus listed versions
1.7.4-21.7.4-2+deb9u11.7.4-2+deb9u2
1.7.4-2+deb9u3
golang-1.8
Debian:9
 before 1.8.1-1+deb9u3, plus listed versions
1.8.1-11.8.1-1+deb9u11.8.1-1+deb9u2
1.8.1-1+deb9u3
toolchain
Go
 before 1.8.4, 1.9.0-0 up to 1.9.1
1.8.41.9.1
golang
Mageia:6
 before 1.9.1-1.mga6
1.9.1-1.mga6
go-toolset-7
Red Hat:devtools:2::el7
 before 0:1.8-10.el7
0:1.8-10.el7
go-toolset-7-build
Red Hat:devtools:2::el7
 before 0:1.8-10.el7
0:1.8-10.el7
go-toolset-7-dockerfiles
Red Hat:devtools:2::el7
 before 0:1.8-10.el7
0:1.8-10.el7
go-toolset-7-golang
Red Hat:devtools:2::el7
 before 0:1.8.5-1.el7
0:1.8.5-1.el7
go-toolset-7-golang-bin
Red Hat:devtools:2::el7
 before 0:1.8.5-1.el7
0:1.8.5-1.el7
Show 21 moreShow less
Affected packages
PackageAffectedFixed
go-toolset-7-golang-docs
Red Hat:devtools:2::el7
 before 0:1.8.5-1.el7
0:1.8.5-1.el7
go-toolset-7-golang-misc
Red Hat:devtools:2::el7
 before 0:1.8.5-1.el7
0:1.8.5-1.el7
go-toolset-7-golang-race
Red Hat:devtools:2::el7
 before 0:1.8.5-1.el7
0:1.8.5-1.el7
go-toolset-7-golang-src
Red Hat:devtools:2::el7
 before 0:1.8.5-1.el7
0:1.8.5-1.el7
go-toolset-7-golang-tests
Red Hat:devtools:2::el7
 before 0:1.8.5-1.el7
0:1.8.5-1.el7
go-toolset-7-runtime
Red Hat:devtools:2::el7
 before 0:1.8-10.el7
0:1.8-10.el7
go-toolset-7-scldevel
Red Hat:devtools:2::el7
 before 0:1.8-10.el7
0:1.8-10.el7
golang
Red Hat:enterprise_linux:7::server
 before 0:1.9.4-1.el7
0:1.9.4-1.el7
golang-bin
Red Hat:enterprise_linux:7::server
 before 0:1.9.4-1.el7
0:1.9.4-1.el7
golang-docs
Red Hat:enterprise_linux:7::server
 before 0:1.9.4-1.el7
0:1.9.4-1.el7
golang-misc
Red Hat:enterprise_linux:7::server
 before 0:1.9.4-1.el7
0:1.9.4-1.el7
golang-src
Red Hat:enterprise_linux:7::server
 before 0:1.9.4-1.el7
0:1.9.4-1.el7
golang-tests
Red Hat:enterprise_linux:7::server
 before 0:1.9.4-1.el7
0:1.9.4-1.el7
golang-1.6
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5
Show 5 moreShow less
1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4
 None known
golang-1.8
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.8.3-2ubuntu11.8.3-2ubuntu1.18.04.1
 None known
go
openSUSE:Tumbleweed
 before 1.17-1.1
1.17-1.1
go1.10
openSUSE:Tumbleweed
 before 1.10.8-8.2
1.10.8-8.2
go1.11
openSUSE:Tumbleweed
 before 1.11.13-10.5
1.11.13-10.5
go1.12
openSUSE:Tumbleweed
 before 1.12.17-4.8
1.12.17-4.8
go1.4
openSUSE:Tumbleweed
 before 1.4.3-12.2
1.4.3-12.2
go1.9
openSUSE:Tumbleweed
 before 1.9.7-11.2
1.9.7-11.2

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 48 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open