9.3

CVE-2018-7187: debian debian_linux

Modified
AliasesMGASA-2018-0238openSUSE-SU-2018:4302-1UBUNTU-CVE-2018-7187
Published 16-02-2018Last modified 05-08-2024

Vulnerability summary

CVE-2018-7187 is a high (CVSS 9.3) vulnerability in debian debian_linux. EPSS estimates a 63.03% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
9.3/10
010
High · v2.0 (NVD)
EPSS score
63.03%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 5 · Related 3
DSA-4379-1DSA-4380-1OPENSUSE-SU-2024:10802-1OPENSUSE-SU-2024:10812-1SUSE-SU-2018:4297-1

Timeline

  1. 16-02-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

63.03%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 63.03% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Go

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Suse3 products
  • go1.10&distro=SUSE Package Hub 15< 1.10.7-bp150.2.1
  • go&distro=SUSE Package Hub 15< 1.10.4-bp150.2.3.1
  • golang-packaging&distro=SUSE Package Hub 15< 15.0.11-bp150.3.3.1
Debian2 products
Ubuntu2 products
  • golang-1.6All versions (No fix recorded)
  • golang-1.9All versions (No fix recorded)
Go1 product
  • toolchain≥ 1.10.0-0, < 1.10.1
Golang1 product
  • go< 1.9.5 | ≥ 1.10, < 1.10.1
Mageia1 product
  • golang< 1.9.4-4.mga6

6 vendors · 10 products

References

20 links
Show all 20 references