CVE-2023-45285

Description

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).

References

https://pkg.go.dev/vuln/GO-2023-2383

https://lists.fedoraproject.org/archives/list/[email protected]/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G/

https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ

https://go.dev/issue/63845

https://go.dev/cl/540257

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-49586

Details

Source: Mitre, NVD

Named Vulnerability: GO-2023-2383Named Vulnerability: GHSA-5f94-vhjq-rpg8

Risk Information

CVSS v2

CVSS v3

EPSS