{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "cpe": [
              "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
              "cpe:2.3:a:golang:go:1.9:-:*:*:*:*:*:*"
            ],
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "1.8.3"
              },
              {
                "introduced": "1.9-NA"
              },
              {
                "last_affected": "1.9-NA"
              }
            ],
            "source": [
              "CPE_RANGE",
              "CPE_STRING"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "352996a381701cfa0c16e8de29cbde8f3922182f"
            },
            {
              "introduced": "c8aec4095e089ff6ac50d18e97c3f46561f14f48"
            },
            {
              "last_affected": "c8aec4095e089ff6ac50d18e97c3f46561f14f48"
            }
          ],
          "repo": "https://github.com/golang/go",
          "type": "GIT"
        }
      ],
      "versions": [
        "1.9-NA"
      ]
    }
  ],
  "database_specific": {
    "unresolved_ranges": [
      {
        "cpes": [
          "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
        ],
        "extracted_events": [
          {
            "introduced": "9.0"
          },
          {
            "last_affected": "9.0"
          }
        ],
        "source": "CPE_STRING",
        "vendor_product": "debian:debian_linux"
      },
      {
        "cpes": [
          "cpe:2.3:a:redhat:developer_tools:1.0:*:*:*:*:*:*:*"
        ],
        "extracted_events": [
          {
            "introduced": "1.0"
          },
          {
            "last_affected": "1.0"
          }
        ],
        "source": "CPE_STRING",
        "vendor_product": "redhat:developer_tools"
      },
      {
        "cpes": [
          "cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*",
          "cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*"
        ],
        "extracted_events": [
          {
            "introduced": "7.6"
          },
          {
            "last_affected": "7.6"
          },
          {
            "introduced": "7.7"
          },
          {
            "last_affected": "7.7"
          }
        ],
        "source": "CPE_STRING",
        "vendor_product": "redhat:enterprise_linux_eus"
      },
      {
        "cpes": [
          "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*"
        ],
        "extracted_events": [
          {
            "introduced": "7.0"
          },
          {
            "last_affected": "7.0"
          }
        ],
        "source": "CPE_STRING",
        "vendor_product": "redhat:enterprise_linux_server"
      },
      {
        "cpes": [
          "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*",
          "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*"
        ],
        "extracted_events": [
          {
            "introduced": "7.6"
          },
          {
            "last_affected": "7.6"
          },
          {
            "introduced": "7.7"
          },
          {
            "last_affected": "7.7"
          }
        ],
        "source": "CPE_STRING",
        "vendor_product": "redhat:enterprise_linux_server_aus"
      },
      {
        "cpes": [
          "cpe:2.3:o:redhat:enterprise_linux_tus:7.6:*:*:*:*:*:*:*",
          "cpe:2.3:o:redhat:enterprise_linux_tus:7.7:*:*:*:*:*:*:*"
        ],
        "extracted_events": [
          {
            "introduced": "7.6"
          },
          {
            "last_affected": "7.6"
          },
          {
            "introduced": "7.7"
          },
          {
            "last_affected": "7.7"
          }
        ],
        "source": "CPE_STRING",
        "vendor_product": "redhat:enterprise_linux_tus"
      }
    ]
  },
  "details": "Go before 1.8.4 and 1.9.x before 1.9.1 allows \"go get\" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, \"go get\" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running \"go get.\"",
  "id": "CVE-2017-15041",
  "modified": "2026-07-08T05:36:34.571565380Z",
  "published": "2017-10-05T21:29:00.427Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "http://www.securityfocus.com/bid/101196"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2017:3463"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2018:0878"
    },
    {
      "type": "ADVISORY",
      "url": "https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ"
    },
    {
      "type": "ADVISORY",
      "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://security.gentoo.org/glsa/201710-23"
    },
    {
      "type": "FIX",
      "url": "https://github.com/golang/go/issues/22125"
    },
    {
      "type": "FIX",
      "url": "https://golang.org/cl/68022"
    },
    {
      "type": "FIX",
      "url": "https://golang.org/cl/68190"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}