CVE-2018-7187 Command injection in n/a
Remote attackers can execute arbitrary OS commands via a crafted website when the insecure flag is used in the Go get command.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-7187?
CVE-2018-7187 is a high-severity command injection vulnerability in Debian Debian Linux, published on 16 Feb 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
Weakness: CWE-78
Which versions are affected by CVE-2018-7187?
1 open source package ship an affected version, including toolchain. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
toolchain Go | All versions | 1.9.5, 1.10.1 |
Linux distribution packages (3)
go SUSE:Package Hub 15 | All versions | 1.10.4-bp150.2.3.1 |
go1.10 SUSE:Package Hub 15 | All versions | 1.10.7-bp150.2.1 |
golang-packaging SUSE:Package Hub 15 | All versions | 15.0.11-bp150.3.3.1 |
Products include Debian Debian Linux, Golang Go.
How do I fix CVE-2018-7187?
Upgrade toolchain to a fixed version for your release line: 1.9.5 or 1.10.1.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-7187 being exploited?
There is no known exploitation of CVE-2018-7187 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DLA-1294-1, GHSA-44r2-v58f-9q85, GO-2022-0203, MGASA-2018-0238, UBUNTU-CVE-2018-7187, openSUSE-SU-2018:4302-1.