CVE catalog
CVE-2018-7187
UBUNTU-CVE-2018-7187
- Severity
- High · CVSS 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 63.03% · Oct 25, 2026
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | golang-1.7 | 9 | 1.7.4-2 | vulnerable |
| Debian | golang-1.7 | 9 | 1.7.4-2+deb9u1 | fixed |
| Debian | golang-1.8 | 9 | 1.8.1-1 | vulnerable |
| Debian | golang-1.8 | 9 | 1.8.1-1+deb9u1 | fixed |
| Debian | golang | 7 | 2:1.0.2-1.1 | vulnerable |
| Debian | golang | 7 | 2:1.0.2-1.1+deb7u1 | vulnerable |
| Debian | golang | 7 | 2:1.0.2-1.1+deb7u2 | vulnerable |
| Debian | golang | 7 | 2:1.0.2-1.1+deb7u3 | fixed |
| Suse | go | package hub 15 | 1.10.4-bp150.2.3.1 | fixed |
| Suse | go1.10 | package hub 15 | 1.10.7-bp150.2.1 | fixed |
| Suse | golang-packaging | package hub 15 | 15.0.11-bp150.3.3.1 | fixed |
| Ubuntu | golang-1.6 | 16.04 | 1.6-0ubuntu1 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6-0ubuntu2 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6-0ubuntu3 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6-0ubuntu4 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6-0ubuntu5 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6.1-0ubuntu1 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6.2-0ubuntu5~16.04 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6.2-0ubuntu5~16.04.2 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6.2-0ubuntu5~16.04.3 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6.2-0ubuntu5~16.04.4 | vulnerable |
| Ubuntu | golang-1.9 | 18.04 | 1.9.1-2ubuntu1 | vulnerable |
| Ubuntu | golang-1.9 | 18.04 | 1.9.2-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.9 | 18.04 | 1.9.2-3ubuntu1 | vulnerable |
| Ubuntu | golang-1.9 | 18.04 | 1.9.3-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.9 | 18.04 | 1.9.4-1ubuntu1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | golang-1.7 | deb | 9 | 1.7.4-2+deb9u1 | Not reported | DSA-4379-1 | Not reported |
| Debian | golang-1.8 | deb | 9 | 1.8.1-1+deb9u1 | Not reported | DSA-4380-1 | Not reported |
| Debian | golang | deb | 7 | 2:1.0.2-1.1+deb7u3 | Not reported | DLA-1294-1 | Not reported |
| Suse | go | rpm | package hub 15 | 1.10.4-bp150.2.3.1 | Not reported | OPENSUSE-SU-2018:4302-1 | Not reported |
| Suse | go1.10 | rpm | package hub 15 | 1.10.7-bp150.2.1 | Not reported | OPENSUSE-SU-2018:4302-1 | Not reported |
| Suse | golang-packaging | rpm | package hub 15 | 15.0.11-bp150.3.3.1 | Not reported | OPENSUSE-SU-2018:4302-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_4297-1.json]
- [https://osv.dev/vulnerability/DLA-1294-1]
- [https://osv.dev/vulnerability/DSA-4379-1]
- [https://osv.dev/vulnerability/DSA-4380-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2018-7187]
- [https://osv.dev/vulnerability/openSUSE-SU-2018:4302-1]
[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]