CVE-2017-15041: debian debian_linux
Vulnerability summary
CVE-2017-15041 is a critical (CVSS 9.8) vulnerability in debian debian_linux. EPSS estimates a 8.94% chance of exploitation in the next 30 days, higher than 95.2% of scored vulnerabilities.
Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 9% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 11 · Related 6Timeline
- 05-10-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
8.94%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
No change 0.00 pp
From 8.94% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat5 products
- developer_tools1.0
- enterprise_linux_eus7.6 | 7.7
- enterprise_linux_server7.0
- enterprise_linux_server_aus7.6 | 7.7
- enterprise_linux_tus7.6 | 7.7
Debian2 products
- golang< 2:1.0.2-1.1+deb7u2
- debian_linuxEOL9.0
Ubuntu2 products
- golang-1.6All versions (No fix recorded)
- golang-1.8All versions (No fix recorded)
Go1 product
- toolchain≥ 1.9.0-0, < 1.9.1
Golang1 product
- go≤ 1.8.3 | 1.9
5 vendors · 11 products
References
16 links- groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJX Refsource CONFIRMMailing ListVendor AdvisoryREPORT
lists.debian.org/debian-lts-announce/2021/03/msg00014.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.debian.org/debian-lts-announce/2021/03/msg00015.htmlMailing ListX Refsource MLISTThird Party Advisory