https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:49:44 +0000 https://cve.radiocsirt.org/vuln/cve-2017-15041 <p>Go before 1.8.4 and 1.9.x before 1.9.1 allows &#34;go get&#34; remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, &#34;go get&#34; can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository&#39;s Git checkout has malicious commands in .git/hooks/, they will execute on the system running &#34;go get.&#34;</p> <p>Go before 1.8.4 and 1.9.x before 1.9.1 allows &#34;go get&#34; remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, &#34;go get&#34; can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository&#39;s Git checkout has malicious commands in .git/hooks/, they will execute on the system running &#34;go get.&#34;</p> https://cve.radiocsirt.org/vuln/cve-2017-15041