GO-2023-2383
Command 'go get' may unexpectedly fallback to insecure git in cmd/go
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2023-45285
- Alias
- BIT-golang-2023-45285
Description
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · toolchain | introduced 0, fixed 1.20.12, introduced 1.21.0-0, fixed 1.21.5 |
Références
- https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ WEB
- https://go.dev/issue/63845 REPORT
- https://go.dev/cl/540257 FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |