{"id":"CVE-2017-15041","aliases":["DEBIAN-CVE-2017-15041","DLA-1148-1","DLA-2591-1","DLA-2592-1","EUVD-2017-6516","GHSA-2w49-qg9p-7jxx","GO-2022-0177","MGASA-2018-0089","RHSA-2017:3463","RHSA-2018:0878","UBUNTU-CVE-2017-15041","openSUSE-SU-2024:10802-1","openSUSE-SU-2024:10803-1","openSUSE-SU-2024:10804-1","openSUSE-SU-2024:10805-1","openSUSE-SU-2024:10811-1","openSUSE-SU-2024:10812-1"],"status":"published","title":"Go before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command execution. Using custom...","description":"Go before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, \"go get\" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running \"go get.\"","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.08944,"percentile":0.95279,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2017-10-05T21:00:00Z","modified":"2026-10-20T10:48:13Z","fixes":[{"ecosystem":"Debian:7","package":"golang","fixed_in":["2:1.0.2-1.1+deb7u2"],"sources":["osv"]},{"ecosystem":"Go","package":"toolchain","fixed_in":["1.8.4","1.9.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.0.2-1.1+deb7u2"}]}],"versions":["2:1.0.2-1.1","2:1.0.2-1.1+deb7u1"]},{"source":"osv","ecosystem":"Debian:9","package":"golang-1.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-2+deb9u3"}]}],"versions":["1.7.4-2","1.7.4-2+deb9u1","1.7.4-2+deb9u2"],"bundled":7},{"source":"osv","ecosystem":"Debian:9","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1+deb9u3"}]}],"versions":["1.8.1-1","1.8.1-1+deb9u1","1.8.1-1+deb9u2"],"bundled":7},{"source":"osv","ecosystem":"Go","package":"toolchain","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.4"},{"introduced":"1.9.0-0"},{"fixed":"1.9.1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8-10.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8-10.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-dockerfiles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8-10.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8-10.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2::el7","package":"go-toolset-7-scldevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8-10.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.4-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.13-10.5"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.17-4.8"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-12.2"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-11.2"}]}],"bundled":9}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"golang","product":"go"},{"vendor":"redhat","product":"developer_tools"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_tus"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:3463","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0878","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://golang.org/cl/68190","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/101196","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://golang.org/cl/68022","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","report"]},{"url":"https://security.gentoo.org/glsa/201710-23","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Vendor Advisory","advisory","report"]},{"url":"https://github.com/golang/go/issues/22125","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15041","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2w49-qg9p-7jxx"},{"url":"https://go.dev/cl/68110","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/ec71ee078fd3243b78c0d404c8634bd97e38d7eb","tags":["fix"]},{"url":"https://go.dev/issue/22125","tags":["report"]},{"url":"https://groups.google.com/g/golang-dev/c/RinSE3EiJBI/m/kYL7zb07AgAJ","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0089.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21857","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/AHH5B4WHCPTVEM6APRVXRWLFOR325CCD/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498870","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3463.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15041","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15041","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15042","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15042","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15042","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/7/html/7.5_release_notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1543561","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0878.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6574","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6574","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6574","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-15041","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17596","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-15041","description":"Go before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, \"go get\" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running \"go get.\"","status":"published","published":"2017-10-05T21:00:00Z","modified":"2024-08-05T19:42:22.368Z","updated_at":"2026-11-02T14:33:14.271248Z"}],"euvd":[{"id":"EUVD-2017-6516","description":"Go before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, \"go get\" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running \"go get.\"","status":"published","published":"2017-10-05T21:00:00Z","modified":"2024-08-05T19:42:22Z","updated_at":"2026-11-03T02:23:15.298105Z"}],"ghsa":[{"id":"GHSA-2w49-qg9p-7jxx","title":"Go before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command execution. Using custom...","description":"Go before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, \"go get\" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running \"go get.\"","status":"published","published":"2022-05-13T01:11:23Z","modified":"2023-02-01T05:03:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:50:05.01868Z"}],"nvd":[{"id":"CVE-2017-15041","description":"Go before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, \"go get\" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running \"go get.\"","status":"published","published":"2017-10-05T21:29:00.427Z","modified":"2026-06-17T01:07:10.683Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:04:01.734197Z"}],"osv":[{"id":"CVE-2017-15041","description":"Go before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, \"go get\" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running \"go get.\"","status":"published","published":"2017-10-05T21:29:00.427Z","modified":"2026-10-20T10:48:13.3422652Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"RHSA-2017:3463","title":"Red Hat Security Advisory: go-toolset-7 and go-toolset-7-golang security and bug fix update","status":"published","published":"2024-09-16T00:48:28Z","modified":"2026-06-26T10:36:08Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:0878","title":"Red Hat Security Advisory: golang security, bug fix, and enhancement update","status":"published","published":"2024-09-16T00:48:22Z","modified":"2026-06-26T10:36:54Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2017-15041","description":"Go before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, \"go get\" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running \"go get.\"","status":"published","published":"2017-10-05T21:29:00Z","modified":"2025-10-24T04:46:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"DLA-1148-1","title":"golang - security update","status":"published","published":"2017-10-27T00:00:00Z","modified":"2026-03-09T01:01:14.171093Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-2591-1","title":"golang-1.7 - security update","status":"published","published":"2021-03-13T00:00:00Z","modified":"2026-03-09T01:21:14.067767Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-2592-1","title":"golang-1.8 - security update","status":"published","published":"2021-03-13T00:00:00Z","modified":"2026-03-09T01:19:13.580096Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"GO-2022-0177","title":"Remote command execution via \"go get\" in cmd/go","description":"The \"go get\" command allows remote command execution.\n\nUsing custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, \"go get\" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running \"go get\".","status":"published","published":"2022-08-09T17:31:35Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2018-0089","title":"Updated golang packages fix security vulnerabilities","description":"An arbitrary command execution flaw was found in the way Go's \"go get\"\ncommand handled the checkout of source code repositories. A remote\nattacker capable of hosting malicious repositories could potentially use\nthis flaw to cause arbitrary command execution on the client side\n(CVE-2017-15041).\n\nIt was found that smtp.PlainAuth authentication scheme in Go did not\nverify the TLS requirement properly. A remote man-in-the-middle attacker\ncould potentially use this flaw to sniff SMTP credentials sent by a Go\napplication (CVE-2017-15042).\n","status":"published","published":"2018-01-21T21:31:56Z","modified":"2026-04-16T06:24:11.553779908Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10802-1","title":"go-1.17-1.1 on GA media","description":"These are all security issues fixed in the go-1.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:22.419368Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10803-1","title":"go1.10-1.10.8-8.2 on GA media","description":"These are all security issues fixed in the go1.10-1.10.8-8.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:41.250328Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10804-1","title":"go1.11-1.11.13-10.5 on GA media","description":"These are all security issues fixed in the go1.11-1.11.13-10.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:47.136272Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10805-1","title":"go1.12-1.12.17-4.8 on GA media","description":"These are all security issues fixed in the go1.12-1.12.17-4.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:28:31.331263Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10811-1","title":"go1.4-1.4.3-12.2 on GA media","description":"These are all security issues fixed in the go1.4-1.4.3-12.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:40:11.062224Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10812-1","title":"go1.9-1.9.7-11.2 on GA media","description":"These are all security issues fixed in the go1.9-1.9.7-11.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:45.429147Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}