Skip to content
Fencer Vulns
critical 9.8

CVE-2017-15041 json

Remote command execution via "go get" in cmd/go

published 2017-10-05 9 y ago modified 2026-06-17 4 mo ago also GO-2022-0177 , EUVD-2017-6516

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
8.9%
EPSS 8.9% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

Patch / fix

  • go toolchain 1.8.4, 1.9.1
  • go-toolset-7 devtools 2 1.8-10.el7
  • go-toolset-7-golang devtools 2 1.8.5-1.el7
  • go-toolset-7-build devtools 2 1.8-10.el7
  • go-toolset-7-runtime devtools 2 1.8-10.el7
  • go-toolset-7-scldevel devtools 2 1.8-10.el7
  • go-toolset-7-golang-bin devtools 2 1.8.5-1.el7
  • go-toolset-7-golang-src devtools 2 1.8.5-1.el7
  • go-toolset-7-dockerfiles devtools 2 1.8-10.el7

red hat advisories RHSA-2017:3463RHSA-2018:0878

  • go openSUSE Tumbleweed 1.17-1.1
  • go1.10 openSUSE Tumbleweed 1.10.8-8.2
  • go1.11 openSUSE Tumbleweed 1.11.13-10.5
  • go1.12 openSUSE Tumbleweed 1.12.17-4.8
  • go1.4 openSUSE Tumbleweed 1.4.3-12.2
  • go1.9 openSUSE Tumbleweed 1.9.7-11.2

opensuse advisories openSUSE-SU-2024:10802-1openSUSE-SU-2024:10803-1openSUSE-SU-2024:10804-1openSUSE-SU-2024:10805-1openSUSE-SU-2024:10811-1openSUSE-SU-2024:10812-1

  • go Arch Linux 2:1.9.1-1

arch linux advisories AVG-442

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-15041 updated cvss 7.5

golang: arbitrary code execution during "go get" or "go get -d"

  • Red Hat OpenShift Enterprise 3 golang
    affected: no fix available
  • Red Hat OpenStack Platform 8 (Liberty) Operational Tools golang, golang-src, golang-pkg-linux-amd64, golang-pkg-bin-linux-amd64 Red Hat OpenStack Platform 9 (Mitaka) Operational Tools golang, golang-bin, golang-src
    affected: no fix planned “Will not fix”
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-7 1.8-10.el7, go-toolset-7-build 1.8-10.el7, go-toolset-7-golang 1.8.5-1.el7, go-toolset-7-runtime 1.8-10.el7, go-toolset-7-scldevel 1.8-10.el7, go-toolset-7-dockerfiles 1.8-10.el7, +5 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-7 1.8-10.el7, go-toolset-7-build 1.8-10.el7, go-toolset-7-golang 1.8.5-1.el7, go-toolset-7-runtime 1.8-10.el7, go-toolset-7-scldevel 1.8-10.el7, go-toolset-7-dockerfiles 1.8-10.el7, +5 more
    fixed: vendor fix RHSA-2017:3463
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) golang 1.9.4-1.el7, golang-bin 1.9.4-1.el7, golang-src 1.9.4-1.el7, golang-misc 1.9.4-1.el7, golang-tests 1.9.4-1.el7 Red Hat Enterprise Linux Server Optional (v. 7) golang 1.9.4-1.el7, golang-bin 1.9.4-1.el7, golang-src 1.9.4-1.el7, golang-misc 1.9.4-1.el7, golang-tests 1.9.4-1.el7
    fixed: vendor fix RHSA-2018:0878

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

8.94% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

ecosystem package affected fixed in
go toolchain
<1.8.4
>=1.9.0-0, <1.9.1
1.8.4
1.9.1

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.