Fluid Attacks Database

Description

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	golang-1.15	=1.15.15-1 \|\| =1.15.15-1~deb11u1 \|\| =1.15.15-1~deb11u2 \|\| =1.15.15-1~deb11u3 \|\| =1.15.15-1~deb11u4 \|\| =1.15.15-2 \|\| =1.15.15-3 \|\| =1.15.15-4 \|\| =1.15.15-5 \|\| =1.15.9-6	-
debian 12	golang-1.19	=1.19.10-1 \|\| =1.19.10-2 \|\| =1.19.11-1 \|\| =1.19.12-1 \|\| =1.19.12-2 \|\| =1.19.12-2~bpo11+1 \|\| =1.19.12-2~bpo12+1 \|\| =1.19.13-1 \|\| =1.19.13-1~bpo11+1 \|\| =1.19.13-1~bpo12+1 \|\| =1.19.8-2 \|\| =1.19.9-1	-
go	toolchain	>=0 <1.20.12	1.20.12
rpm rhel9	golang	<0:1.20.12-1.el9_3	0:1.20.12-1.el9_3
rpm rhel8	go-toolset	<0:1.20.12-1.module+el8.9.0+21033+5795bdf6	0:1.20.12-1.module+el8.9.0+21033+5795bdf6

Aliases

1. CVE-2023-452852. NVD-2023-452853. OSV-DEBIAN-2023-452854. OSV-2023-452855. OSV-GO-2023-23836. GCVE-2023-452857. SECURITY-TRACKER-CVE-2023-45285

References

1. https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ2. https://go.dev/issue/638453. https://go.dev/cl/540257

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.