p PatchFirst

CVE-2023-45285

CVE-2023-45285 · Command 'go get' may unexpectedly fallback to insecure git in cmd/go

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).

CVSS 7.5 · High · EPSS 1.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • cmd/go

    Versions
    • ≥ 0, < 1.20.12: Affected (semver)
    • ≥ 1.21.0-0, < 1.21.5: Affected (semver)

    Update to 1.20.12; Update to 1.21.5

  • golang-1.19 Debian:12

    Versions
    • 1.19.10-1
    • 1.19.10-2
    • 1.19.11-1
    • 1.19.12-1
    • 1.19.12-2
    • 1.19.12-2~bpo11+1
    • 1.19.12-2~bpo12+1
    • 1.19.13-1
    • 1.19.13-1~bpo11+1
    • 1.19.13-1~bpo12+1
    • 1.19.8-2
    • 1.19.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.20 Ubuntu:20.04:LTS

    Versions
    • 1.20.3-1ubuntu0.1~20.04
    Affected ranges
    • ECOSYSTEM: < 1.20.3-1ubuntu0.1~20.04.1

    Update to 1.20.3-1ubuntu0.1~20.04.1

  • golang-1.21 Ubuntu:20.04:LTS

    Versions
    • 1.21.1-1~ubuntu20.04.1
    Affected ranges
    • ECOSYSTEM: < 1.21.1-1~ubuntu20.04.2

    Update to 1.21.1-1~ubuntu20.04.2

  • golang-1.20 Ubuntu:22.04:LTS

    Versions
    • 1.20.3-1ubuntu0.1~22.04
    Affected ranges
    • ECOSYSTEM: < 1.20.3-1ubuntu0.1~22.04.1

    Update to 1.20.3-1ubuntu0.1~22.04.1

  • golang-1.21 Ubuntu:22.04:LTS

    Versions
    • 1.21.1-1~ubuntu22.04.1
    Affected ranges
    • ECOSYSTEM: < 1.21.1-1~ubuntu22.04.2

    Update to 1.21.1-1~ubuntu22.04.2

Original sources

Check your server →