The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
| Link | Tags |
|---|---|
| https://lists.debian.org/debian-lts-announce/2018/02/msg00029.html | third party advisory mailing list |
| https://www.debian.org/security/2019/dsa-4380 | third party advisory vendor advisory |
| https://security.gentoo.org/glsa/201804-12 | third party advisory vendor advisory |
| https://www.debian.org/security/2019/dsa-4379 | third party advisory vendor advisory |
| https://github.com/golang/go/issues/23867 | third party advisory issue tracking exploit |
| https://gist.github.com/SLAYEROWNER/b2a358f13ab267f2e9543bb9f9320ffc | third party advisory |