Vulnerability · Published Dec 6, 2023 · Assigned by Go
CVE-2023-45285Command 'go get' may unexpectedly fallback to insecure git in cmd/go
High 7.5
In plain English
A high-severity security flaw in cmd/go from Go toolchain. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.1%top 33.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | delve | 1.20.2-1.module_el8.9.0+3642+43318da8 | ALSA-2024:0887 |
| AlmaLinux:8 | go-toolset | 1.20.12-1.module_el8.9.0+3728+f1d47c6f | ALSA-2024:0887 |
| AlmaLinux:9 | go-toolset | 1.20.12-1.el9_3 | ALSA-2024:1131 |
| AlmaLinux:8 | golang | 1.20.12-2.module_el8.9.0+3728+f1d47c6f | ALSA-2024:0887 |
| AlmaLinux:9 | golang | 1.20.12-1.el9_3 | ALSA-2024:1131 |
| AlmaLinux:8 | golang-bin | 1.20.12-2.module_el8.9.0+3728+f1d47c6f | ALSA-2024:0887 |
| AlmaLinux:9 | golang-bin | 1.20.12-1.el9_3 | ALSA-2024:1131 |
| AlmaLinux:8 | golang-docs | 1.20.12-2.module_el8.9.0+3728+f1d47c6f | ALSA-2024:0887 |
| AlmaLinux:9 | golang-docs | 1.20.12-1.el9_3 | ALSA-2024:1131 |
| AlmaLinux:8 | golang-misc | 1.20.12-2.module_el8.9.0+3728+f1d47c6f | ALSA-2024:0887 |
| AlmaLinux:9 | golang-misc | 1.20.12-1.el9_3 | ALSA-2024:1131 |
| AlmaLinux:8 | golang-src | 1.20.12-2.module_el8.9.0+3728+f1d47c6f | ALSA-2024:0887 |
| AlmaLinux:9 | golang-src | 1.20.12-1.el9_3 | ALSA-2024:1131 |
| AlmaLinux:8 | golang-tests | 1.20.12-2.module_el8.9.0+3728+f1d47c6f | ALSA-2024:0887 |
| AlmaLinux:9 | golang-tests | 1.20.12-1.el9_3 | ALSA-2024:1131 |
| Debian:12 | golang-1.19 | no fix listed | DEBIAN-CVE-2023-45285 |
| Go | toolchain | 1.20.12, 1.21.5 | GO-2023-2383 |
| Ubuntu:22.04:LTS | golang-1.20 | 1.20.3-1ubuntu0.1~22.04.1 | USN-6574-1 |
| Ubuntu:22.04:LTS | golang-1.20 | 1.20.3-1ubuntu0.1~22.04.1 | UBUNTU-CVE-2023-45285 |
| Ubuntu:22.04:LTS | golang-1.21 | 1.21.1-1~ubuntu22.04.2 | USN-6574-1 |
| Ubuntu:22.04:LTS | golang-1.21 | 1.21.1-1~ubuntu22.04.2 | UBUNTU-CVE-2023-45285 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go toolchain | cmd/go | 0 – before 1.20.121.21.0-0 – before 1.21.5 |