Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go1.10Upgrade go | Feb 26, 2018 | Feb 7, 2018 |
| Amazon Linux Ami 2 | — | Upgrade golang-srcUpgrade golangUpgrade golang-miscUpgrade golang-binUpgrade golang-testsUpgrade golang-docs | Apr 27, 2020 | Feb 7, 2018 |
| Amazon_linux | — | Upgrade golang | Mar 25, 2018 | Feb 7, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 7, 2018 |
| Centos_linux | — | Upgrade golang-binUpgrade golang-testsUpgrade golang-docsUpgrade golang-miscUpgrade golangUpgrade golang-src | Aug 28, 2019 | Feb 7, 2018 |
| Debian | — | Upgrade golang-1.8 | Feb 2, 2019 | Feb 7, 2018 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Mar 8, 2018 | Feb 7, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade golang-srcUpgrade golangUpgrade golang-bin | Sep 28, 2020 | Feb 7, 2018 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Feb 7, 2018 |
| Redhat_linux | — | Upgrade golang-srcUpgrade golangUpgrade golang-miscUpgrade golang-docsUpgrade golang-testsUpgrade golang-bin | Apr 11, 2018 | Feb 7, 2018 |
| Suse | — | Upgrade go1.9-docUpgrade goUpgrade go1.9Upgrade go-raceUpgrade go-docUpgrade go1.8-raceUpgrade go1.9-raceUpgrade go1.8Upgrade go1.8-doc | Mar 10, 2018 | Feb 7, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Feb 7, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 7, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub