GO-2025-3383
GOAUTH credential leak in cmd/go
At a glance
- Published
- Updated
- CVE
- CVE-2024-45340
- Aliases
- BIT-golang-2024-45340
Description
Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.
Affected packages
| Package | Versions |
|---|---|
| Go · toolchain | introduced 1.24.0-0, fixed 1.24.0-rc.2 |
References
- https://go.dev/cl/643097 FIX
- https://go.dev/issue/71249 REPORT
- https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |