Vulnerability Report: GO-2023-2383
- CVE-2023-45285
- Affects: cmd/go
- Published: Dec 06, 2023
- Modified: May 20, 2024
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
Affected Packages
-
PathVersionsSymbols
-
before go1.20.12, from go1.21.0-0 before go1.21.5all symbols
Aliases
References
- https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
- https://go.dev/issue/63845
- https://go.dev/cl/540257
- https://vuln.go.dev/ID/GO-2023-2383.json
Credits
- David Leadbeater
Feedback
See anything missing or incorrect?
Suggest an edit to this report.