[GO-2023-2383] Command 'go get' may unexpectedly fallback to insecure git in cmd/go
Severity
High
Affected Packages
2
Fixed Packages
2
CVEs
1
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback
to the insecure "git://" protocol if the module is unavailable via the secure
"https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said
module. This only affects users who are not using the module proxy and are
fetching modules directly (i.e. GOPROXY=off).
| Package | Affected Version |
|---|---|
 pkg:golang/cmd/go
|
>= 1.21.4, < 1.20.12 |
|
pkg:golang/cmd/go
|
>= 1.21.4, < 1.21.5 |
| Package | Fixed Version |
|---|---|
|
pkg:golang/cmd/go
|
= 1.20.12 |
|
pkg:golang/cmd/go
|
= 1.21.5 |
- ID
- GO-2023-2383
- Severity
- high
- Severity from
- CVE-2023-45285
- URL
- https://pkg.go.dev/vuln/GO-2023-2383
- Published
-
2023-12-05T20:00:18
(9 months ago) - Modified
-
2024-07-17T19:54:18
(2 months ago) - Other Advisories
ALSA-2024:0887
ELSA-2024-0887
FEDORA-2024-193547def8
GLSA-202408-07
RHSA-2024:0887
SUSE-SU-2023:4708-1
USN-6574-1| # CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
|---|---|---|---|---|---|---|---|---|---|---|---|
| # CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |