{"id":"CVE-2018-7187","aliases":["DEBIAN-CVE-2018-7187","DLA-1294-1","DSA-4379-1","DSA-4380-1","EUVD-2018-18929","GHSA-44r2-v58f-9q85","GO-2022-0203","MGASA-2018-0238","SUSE-SU-2018:4297-1","UBUNTU-CVE-2018-7187","openSUSE-SU-2018:4302-1","openSUSE-SU-2024:10802-1","openSUSE-SU-2024:10812-1"],"status":"published","title":"The \"go get\" implementation in Go 1.9.4, when the -insecure command-line option is used, does not...","description":"The \"go get\" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for \"://\" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.63027,"percentile":0.99206,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2018-02-16T17:00:00Z","modified":"2026-10-20T10:49:56Z","fixes":[{"ecosystem":"Debian:7","package":"golang","fixed_in":["2:1.0.2-1.1+deb7u3"],"sources":["osv"]},{"ecosystem":"Go","package":"toolchain","fixed_in":["1.9.5","1.10.1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"golang","fixed_in":["1.9.4-4.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15","package":"go","fixed_in":["1.10.4-bp150.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15","package":"go1.10","fixed_in":["1.10.7-bp150.2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15","package":"golang-packaging","fixed_in":["15.0.11-bp150.3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.0.2-1.1+deb7u3"}]}],"versions":["2:1.0.2-1.1","2:1.0.2-1.1+deb7u1","2:1.0.2-1.1+deb7u2"]},{"source":"osv","ecosystem":"Debian:9","package":"golang-1.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-2+deb9u1"}]}],"versions":["1.7.4-2"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1+deb9u1"}]}],"versions":["1.8.1-1"],"bundled":3},{"source":"osv","ecosystem":"Go","package":"toolchain","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.5"},{"introduced":"1.10.0-0"},{"fixed":"1.10.1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-4.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-5.3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.06.1_ce-6.8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-bp150.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"go1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.7-bp150.2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"golang-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.11-bp150.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-11.2"}]}],"bundled":9}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"golang","product":"go"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00029.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4380","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201804-12","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4379","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/golang/go/issues/23867","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://gist.github.com/SLAYEROWNER/b2a358f13ab267f2e9543bb9f9320ffc","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7187"},{"url":"https://github.com/advisories/GHSA-44r2-v58f-9q85"},{"url":"https://go.dev/cl/94603","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/c941e27e70c3e06e1011d2dd71d72a7a06a9bcbc","tags":["fix"]},{"url":"https://go.dev/issue/23867","tags":["report"]},{"url":"https://groups.google.com/g/golang-announce/c/IkPkOF8JqLs/m/TFBbWHJYAwAJ","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0238.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22812","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BZKVEAK5ZG3B4FJLZVMX3HIQ73RHC4VW/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20184297-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1047218","tags":["report"]},{"url":"https://bugzilla.suse.com/1074971","tags":["report"]},{"url":"https://bugzilla.suse.com/1080978","tags":["report"]},{"url":"https://bugzilla.suse.com/1081495","tags":["report"]},{"url":"https://bugzilla.suse.com/1084533","tags":["report"]},{"url":"https://bugzilla.suse.com/1086185","tags":["report"]},{"url":"https://bugzilla.suse.com/1094680","tags":["report"]},{"url":"https://bugzilla.suse.com/1095817","tags":["report"]},{"url":"https://bugzilla.suse.com/1098017","tags":["report"]},{"url":"https://bugzilla.suse.com/1102522","tags":["report"]},{"url":"https://bugzilla.suse.com/1104821","tags":["report"]},{"url":"https://bugzilla.suse.com/1105000","tags":["report"]},{"url":"https://bugzilla.suse.com/1108038","tags":["report"]},{"url":"https://bugzilla.suse.com/1113313","tags":["report"]},{"url":"https://bugzilla.suse.com/1113978","tags":["report"]},{"url":"https://bugzilla.suse.com/1114209","tags":["report"]},{"url":"https://bugzilla.suse.com/1118897","tags":["report"]},{"url":"https://bugzilla.suse.com/1118898","tags":["report"]},{"url":"https://bugzilla.suse.com/1118899","tags":["report"]},{"url":"https://bugzilla.suse.com/1119634","tags":["report"]},{"url":"https://bugzilla.suse.com/1119706","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7187","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-7187","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7187","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PZCRXEXMCF6XFL7IRZ3SXSULVBU2CDJD/#PZCRXEXMCF6XFL7IRZ3SXSULVBU2CDJD","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3959","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-7187","description":"The \"go get\" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for \"://\" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.","status":"published","published":"2018-02-16T17:00:00Z","modified":"2024-08-05T06:24:10.498Z","updated_at":"2026-11-02T14:35:10.313768Z"}],"euvd":[{"id":"EUVD-2018-18929","description":"The \"go get\" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for \"://\" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.","status":"published","published":"2018-02-16T17:00:00Z","modified":"2024-08-05T06:24:10Z","updated_at":"2026-11-03T02:40:06.682302Z"}],"ghsa":[{"id":"GHSA-44r2-v58f-9q85","title":"The \"go get\" implementation in Go 1.9.4, when the -insecure command-line option is used, does not...","description":"The \"go get\" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for \"://\" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.","status":"published","published":"2022-05-14T01:30:10Z","modified":"2023-01-28T05:01:15Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:43:31.850485Z"}],"nvd":[{"id":"CVE-2018-7187","description":"The \"go get\" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for \"://\" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.","status":"published","published":"2018-02-16T17:29:00.403Z","modified":"2026-06-17T02:02:45.977Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:04:23.783914Z"}],"osv":[{"id":"CVE-2018-7187","description":"The \"go get\" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for \"://\" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.","status":"published","published":"2018-02-16T17:29:00.403Z","modified":"2026-10-20T10:49:56.484909091Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"UBUNTU-CVE-2018-7187","description":"The \"go get\" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for \"://\" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.","status":"published","published":"2018-02-16T17:29:00Z","modified":"2025-10-24T04:46:56Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"DLA-1294-1","title":"golang - security update","status":"published","published":"2018-02-25T00:00:00Z","modified":"2026-03-09T01:01:01.239587Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4379-1","title":"golang-1.7 - security update","status":"published","published":"2019-02-01T00:00:00Z","modified":"2026-03-09T02:10:56.796999Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"DSA-4380-1","title":"golang-1.8 - security update","status":"published","published":"2019-02-01T00:00:00Z","modified":"2026-03-09T02:09:57.151142Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"GO-2022-0203","title":"Remote command execution via \"go get\" command with \"-insecure\" option in cmd/go","description":"The \"go get\" command is vulnerable to remote code execution.\n\nWhen the -insecure command-line option is used, \"go get\" does not validate the import path (get/vcs.go only checks for \"://\" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.","status":"published","published":"2022-08-09T23:19:00Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2018-0238","title":"Updated golang packages fix security vulnerability","description":"A flaw was found in Go Lang. The \"go get\" implementation in Go 1.9.4,\nwhen the -insecure command-line option is used, does not validate the\nimport path (get/vcs.go only checks for \"://\" anywhere in the string),\nwhich allows remote attackers to execute arbitrary OS commands via a\ncrafted web site (CVE-2018-7187)\n","status":"published","published":"2018-05-16T08:24:56Z","modified":"2026-04-16T06:25:14.914123888Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2018:4302-1","title":"Security update for go","description":"This update for go fixes the following issues:\n\n- golang: arbitrary command execution via VCS path (bsc#1081495, CVE-2018-7187)\n- Make profile.d/go.sh no longer set GOROOT=, in order to make switching\n  between versions no longer break. This ends up removing the need for go.sh\n  entirely (because GOPATH is also set automatically) (boo#1119634)\n- Fix a regression that broke go get for import path patterns containing '...'\n  (bsc#1119706)\n\nAdditionally, the package go1.10 has been added.\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2018-12-29T10:20:00Z","modified":"2026-02-04T03:22:44.091197Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10802-1","title":"go-1.17-1.1 on GA media","description":"These are all security issues fixed in the go-1.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:22.419368Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10812-1","title":"go1.9-1.9.7-11.2 on GA media","description":"These are all security issues fixed in the go1.9-1.9.7-11.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:45.429147Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:4297-1","title":"Security update for containerd, docker and go","description":"\nThis update for containerd, docker and go fixes the following issues:\n\ncontainerd and docker:\n\n- Add backport for building containerd (bsc#1102522, bsc#1113313)\n- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.\n  (bsc#1102522)\n- Enable seccomp support on SLE12 (fate#325877)\n- Update to containerd v1.1.1, which is the required version for the Docker\n  v18.06.0-ce upgrade. (bsc#1102522)\n- Put containerd under the podruntime slice (bsc#1086185) \n- 3rd party registries used the default Docker certificate (bsc#1084533)\n- Handle build breakage due to missing 'export GOPATH' (caused by resolution of\n  boo#1119634). I believe Docker is one of the only packages with this problem.\n\ngo:\n  \n- golang: arbitrary command execution via VCS path (bsc#1081495, CVE-2018-7187)\n- Make profile.d/go.sh no longer set GOROOT=, in order to make switching\n  between versions no longer break. This ends up removing the need for go.sh\n  entirely (because GOPATH is also set automatically) (boo#1119634)\n- Fix a regression that broke go get for import path patterns containing '...'\n  (bsc#1119706)\n\nAdditionally, the package go1.10 has been added.\n","status":"published","published":"2018-12-28T17:39:11Z","modified":"2026-02-04T04:26:39.006391Z","updated_at":"2026-11-02T15:53:45.926331Z"}]}}