Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go1.10Upgrade go | Feb 26, 2018 | Feb 7, 2018 |
| Amazon Linux Ami 2 | — | Upgrade golang-srcUpgrade golangUpgrade golang-docsUpgrade golang-testsUpgrade golang-miscUpgrade golang-bin | Apr 27, 2020 | Feb 7, 2018 |
| Amazon_linux | — | Upgrade golang | Mar 25, 2018 | Feb 7, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 7, 2018 |
| Centos_linux | — | Upgrade golang-docsUpgrade golang-binUpgrade golang-testsUpgrade golang-srcUpgrade golangUpgrade golang-misc | Aug 28, 2019 | Feb 7, 2018 |
| Debian | — | Upgrade golang-1.8 | Feb 2, 2019 | Feb 7, 2018 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Mar 8, 2018 | Feb 7, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade golangUpgrade golang-srcUpgrade golang-bin | Sep 28, 2020 | Feb 7, 2018 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Feb 7, 2018 |
| Redhat_linux | — | Upgrade golangUpgrade golang-miscUpgrade golang-srcUpgrade golang-docsUpgrade golang-binUpgrade golang-tests | Apr 11, 2018 | Feb 7, 2018 |
| Suse | — | Upgrade go-docUpgrade go1.8-raceUpgrade go-raceUpgrade go1.9-docUpgrade go1.9Upgrade goUpgrade go1.8-docUpgrade go1.9-raceUpgrade go1.8 | Mar 10, 2018 | Feb 7, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Feb 7, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 7, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub