Unexpected command execution in untrusted VCS repositories i…(CVE-2025-4674)

概要

Unexpected command execution in untrusted VCS repositories in cmd/go

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.23.11"},{"introduced":"1.24.0-0"},{"fixed":"1.24.5"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2025-4674 golang-1.15
Ubuntu UBUNTU-CVE-2025-4674 golang-1.10

参照URL

advisory nvd.nist.gov
advisory github.com
web go.dev
web go.dev
web groups.google.com
web pkg.go.dev
web openwall.com
web pkg.go.dev