Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go1.10Upgrade go | Feb 26, 2018 | Feb 7, 2018 |
| Amazon Linux Ami 2 | — | Upgrade golang-srcUpgrade golang-docsUpgrade golang-binUpgrade golang-miscUpgrade golang-testsUpgrade golang | Apr 27, 2020 | Feb 7, 2018 |
| Amazon_linux | — | Upgrade golang | Mar 25, 2018 | Feb 7, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 7, 2018 |
| Centos_linux | — | Upgrade golang-srcUpgrade golangUpgrade golang-miscUpgrade golang-docsUpgrade golang-testsUpgrade golang-bin | Aug 28, 2019 | Feb 7, 2018 |
| Debian | — | Upgrade golang-1.8 | Feb 2, 2019 | Feb 7, 2018 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Mar 8, 2018 | Feb 7, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade golang-binUpgrade golang-srcUpgrade golang | Sep 28, 2020 | Feb 7, 2018 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Feb 7, 2018 |
| Redhat_linux | — | Upgrade golang-miscUpgrade golang-srcUpgrade golangUpgrade golang-testsUpgrade golang-binUpgrade golang-docs | Apr 11, 2018 | Feb 7, 2018 |
| Suse | — | Upgrade go1.8Upgrade go1.8-docUpgrade go1.9-raceUpgrade go1.8-raceUpgrade goUpgrade go-docUpgrade go1.9-docUpgrade go1.9Upgrade go-race | Mar 10, 2018 | Feb 7, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Feb 7, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 7, 2018 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub