CVE-2023-45283
Insecure parsing of Windows paths with a \??\ prefix in path/filepath
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a..??\b into the root local device path ??\b. Clean will now convert this to .??\b. Similarly, Join(, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path ??\b. Join will now convert this to .??\b. In addition, with fix, IsAbs now correctly reports paths beginning with ??\ as absolute, and VolumeName correctly reports the ??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with ?, resulting in filepath.Clean(?\c:) returning ?\c: rather than ?\c:\ (among other effects). The previous behavior has been restored.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a..??\b into the root local device path ??\b. Clean will now convert this to .??\b. Similarly, Join(, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path ??\b. Join will now convert this to .??\b. In addition, with fix, IsAbs now correctly reports paths beginning with ??\ as absolute, and VolumeName correctly reports the ??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with ?, resulting in filepath.Clean(?\c:) returning ?\c: rather than ?\c:\ (among other effects). The previous behavior has been restored.
- Record
CVE-2023-45283- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Insecure parsing of Windows paths with a \??\ prefix in path/filepath
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a..??\b into the root local device path ??\b. Clean will now convert this to .??\b. Similarly, Join(, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path ??\b. Join will now convert this to .??\b. In addition, with fix, IsAbs now correctly reports paths beginning with ??\ as absolute, and VolumeName correctly reports the ??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with ?, resulting in filepath.Clean(?\c:) returning ?\c: rather than ?\c:\ (among other effects). The previous behavior has been restored.
- Record
CVE-2023-45283- Updated
- 2026-11-02
EUVDEUVD-2023-49584 No score
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a..??\b into the root local device path ??\b. Clean will now convert this to .??\b. Similarly, Join(, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path ??\b. Join will now convert this to .??\b. In addition, with fix, IsAbs now correctly reports paths beginning with ??\ as absolute, and VolumeName correctly reports the ??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with ?, resulting in filepath.Clean(?\c:) returning ?\c: rather than ?\c:\ (among other effects). The previous behavior has been restored.
- Record
EUVD-2023-49584- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vvjp-q62m-2vph
The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path...
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a..??\b into the root local device path ??\b. Clean will now convert this to .??\b. Similarly, Join(, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path ??\b. Join will now convert this to .??\b. In addition, with fix, IsAbs now correctly reports paths beginning with ??\ as absolute, and VolumeName correctly reports the ??\ prefix as a volume name.
- Record
GHSA-vvjp-q62m-2vph- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVAZL-31897
CVE-2023-45283 affecting package msft-golang for versions less than 1.20.11-1
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a..??\b into the root local device path ??\b. Clean will now convert this to .??\b. Similarly, Join(, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path ??\b. Join will now convert this to .??\b. In addition, with fix, IsAbs now correctly reports paths beginning with ??\ as absolute, and VolumeName correctly reports the ??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with ?, resulting in filepath.Clean(?\c:) returning ?\c: rather than ?\c:\ (among other effects). The previous behavior has been restored.
- Record
AZL-31897- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVAZL-37397
CVE-2023-45283 affecting package golang for versions less than 1.21.6-1
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a..??\b into the root local device path ??\b. Clean will now convert this to .??\b. Similarly, Join(, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path ??\b. Join will now convert this to .??\b. In addition, with fix, IsAbs now correctly reports paths beginning with ??\ as absolute, and VolumeName correctly reports the ??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with ?, resulting in filepath.Clean(?\c:) returning ?\c: rather than ?\c:\ (among other effects). The previous behavior has been restored.
- Record
AZL-37397- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 17 moreShow less
OSVAZL-37444
CVE-2023-45283 affecting package golang for versions less than 1.21.6-1
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a..??\b into the root local device path ??\b. Clean will now convert this to .??\b. Similarly, Join(, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path ??\b. Join will now convert this to .??\b. In addition, with fix, IsAbs now correctly reports paths beginning with ??\ as absolute, and VolumeName correctly reports the ??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with ?, resulting in filepath.Clean(?\c:) returning ?\c: rather than ?\c:\ (among other effects). The previous behavior has been restored.
- Record
AZL-37444- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVAZL-79034
CVE-2023-45283 affecting package golang 1.26.10-1
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a..??\b into the root local device path ??\b. Clean will now convert this to .??\b. Similarly, Join(, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path ??\b. Join will now convert this to .??\b. In addition, with fix, IsAbs now correctly reports paths beginning with ??\ as absolute, and VolumeName correctly reports the ??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with ?, resulting in filepath.Clean(?\c:) returning ?\c: rather than ?\c:\ (among other effects). The previous behavior has been restored.
- Record
AZL-79034- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-05
OSVAZL-98664
CVE-2023-45283 affecting package golang 1.27.1-1
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a..??\b into the root local device path ??\b. Clean will now convert this to .??\b. Similarly, Join(, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path ??\b. Join will now convert this to .??\b. In addition, with fix, IsAbs now correctly reports paths beginning with ??\ as absolute, and VolumeName correctly reports the ??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with ?, resulting in filepath.Clean(?\c:) returning ?\c: rather than ?\c:\ (among other effects). The previous behavior has been restored.
- Record
AZL-98664- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-45283
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a..??\b into the root local device path ??\b. Clean will now convert this to .??\b. Similarly, Join(, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path ??\b. Join will now convert this to .??\b. In addition, with fix, IsAbs now correctly reports paths beginning with ??\ as absolute, and VolumeName correctly reports the ??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with ?, resulting in filepath.Clean(?\c:) returning ?\c: rather than ?\c:\ (among other effects). The previous behavior has been restored.
- Record
DEBIAN-CVE-2023-45283- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-45283
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a..??\b into the root local device path ??\b. Clean will now convert this to .??\b. Similarly, Join(, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path ??\b. Join will now convert this to .??\b. In addition, with fix, IsAbs now correctly reports paths beginning with ??\ as absolute, and VolumeName correctly reports the ??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with ?, resulting in filepath.Clean(?\c:) returning ?\c: rather than ?\c:\ (among other effects). The previous behavior has been restored.
- Record
UBUNTU-CVE-2023-45283- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVBIT-golang-2023-45283 No score
Insecure parsing of Windows paths with a \??\ prefix in path/filepath
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a..??\b into the root local device path ??\b. Clean will now convert this to .??\b. Similarly, Join(, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path ??\b. Join will now convert this to .??\b. In addition, with fix, IsAbs now correctly reports paths beginning with ??\ as absolute, and VolumeName correctly reports the ??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with ?, resulting in filepath.Clean(?\c:) returning ?\c: rather than ?\c:\ (among other effects). The previous behavior has been restored.
- Record
BIT-golang-2023-45283- Updated
- 2026-11-02
OSV No score
Insecure parsing of Windows paths with a \??\ prefix in path/filepath
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a..??\b into the root local device path ??\b. Clean will now convert this to .??\b. Similarly, Join(, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path ??\b. Join will now convert this to .??\b. In addition, with fix, IsAbs now correctly reports paths beginning with ??\ as absolute, and VolumeName correctly reports the ??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with ?, resulting in filepath.Clean(?\c:) returning ?\c: rather than ?\c:\ (among other effects). The previous behavior has been restored.
- Record
CVE-2023-45283- Updated
- 2026-11-02
OSVGO-2023-2185 No score
Insecure parsing of Windows paths with a \??\ prefix in path/filepath
The filepath package does not recognize paths with a ??\ prefix as special.
On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x is equivalent to the more common path c:\x.
Before fix, Clean could convert a rooted path such as \a..??\b into the root local device path ??\b. Clean will now convert this to .??\b.
Similarly, Join(, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path ??\b. Join will now convert this to .??\b.
In addition, with fix, IsAbs now correctly reports paths beginning with ??\ as absolute, and VolumeName correctly reports the ??\ prefix as a volume name.
UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with ?, resulting in filepath.Clean(?\c:) returning ?\c: rather than ?\c:\ (among other effects). The previous behavior has been restored.
- Record
GO-2023-2185- Updated
- 2026-11-02
OSVMGASA-2023-0349 No score
Updated golang packages fix security vulnerabilities
Update to upstream golang 1.21.5 to fix CVE-2023-39326 and CVE-2023-4528[35] In Mageia 8, this update also allows build nodes to build docker stack
- Record
MGASA-2023-0349- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13406-1 No score
go1.20-1.20.11-1.1 on GA media
These are all security issues fixed in the go1.20-1.20.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13406-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13407-1 No score
go1.21-1.21.4-1.1 on GA media
These are all security issues fixed in the go1.21-1.21.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13407-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13506-1 No score
traefik-2.10.7-1.1 on GA media
These are all security issues fixed in the traefik-2.10.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13506-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14076-1 No score
traefik2-2.11.5-1.1 on GA media
These are all security issues fixed in the traefik2-2.11.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14076-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4469-1 No score
Security update for go1.21-openssl
This update for go1.21-openssl fixes the following issues:
Update to version 1.21.4.1 cut from the go1.21-openssl-fips branch at the revision tagged go1.21.4-1-openssl-fips.
- Update to go1.21.4
go1.21.4 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker, the runtime, the compiler, and the go/types, net/http, and runtime/cgo packages.
- security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)
- spec: update unification rules
- cmd/compile: internal compiler error: expected struct value to have type struct
- cmd/link: split text sections for arm 32-bit
- runtime: MADV_COLLAPSE causes production performance issues on Linux
- go/types, x/tools/go/ssa: panic: type param without replacement encountered
- cmd/compile: -buildmode=c-archive produces code not suitable for use in a shared object on arm64
- net/http: http2 page fails on firefox/safari if pushing resources
Initial package go1.21-openssl version 1.21.3.1 cut from the go1.21-openssl-fips branch at the revision tagged go1.21.3-1-openssl-fips. (jsc#SLE-18320)
- Go upstream merged branch dev.boringcrypto in go1.19+.
- In go1.x enable BoringCrypto via GOEXPERIMENT=boringcrypto.
- In go1.x-openssl enable FIPS mode (or boring mode as the package is named) either via an environment variable GOLANG_FIPS=1 or by virtue of booting the host in FIPS mode.
- When the operating system is operating in FIPS mode, Go applications which import crypto/tls/fipsonly limit operations to the FIPS ciphersuite.
- go1.x-openssl is delivered as two large patches to go1.x applying necessary modifications from the golang-fips/go GitHub project for the Go crypto library to use OpenSSL as the external cryptographic library in a FIPS compliant way.
- go1.x-openssl modifies the crypto/* packages to use OpenSSL for cryptographic operations.
- go1.x-openssl uses dlopen() to call into OpenSSL.
- SUSE RPM packaging introduces a fourth version digit go1.x.y.z corresponding to the golang-fips/go patchset tagged revision.
- Patchset improvements can be updated independently of upstream Go maintenance releases.
- Record
SUSE-SU-2023:4469-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4470-1 No score
Security update for go1.20
This update for go1.20 fixes the following issues:
go1.20.11 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker and the net/http package.
- security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)
- cmd/link: split text sections for arm 32-bit
- net/http: http2 page fails on firefox/safari if pushing resources
- Record
SUSE-SU-2023:4470-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4471-1 No score
Security update for go1.21
This update for go1.21 fixes the following issues:
go1.21.4 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker, the runtime, the compiler, and the go/types, net/http, and runtime/cgo packages.
- security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)
- spec: update unification rules
- cmd/compile: internal compiler error: expected struct value to have type struct
- cmd/link: split text sections for arm 32-bit
- runtime: MADV_COLLAPSE causes production performance issues on Linux
- go/types, x/tools/go/ssa: panic: type param without replacement encountered
- cmd/compile: -buildmode=c-archive produces code not suitable for use in a shared object on arm64
- net/http: http2 page fails on firefox/safari if pushing resources
- Record
SUSE-SU-2023:4471-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4472-1 No score
Security update for go1.20-openssl
This update for go1.20-openssl fixes the following issues:
Update to version 1.20.11.1 cut from the go1.20-openssl-fips branch at the revision tagged go1.20.11-1-openssl-fips.
- Update to go1.20.11
go1.20.11 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker and the net/http package.
- security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)
- cmd/link: split text sections for arm 32-bit
- net/http: http2 page fails on firefox/safari if pushing resources
Update to version 1.20.10.1 cut from the go1.20-openssl-fips branch at the revision tagged go1.20.10-1-openssl-fips.
- Update to go1.20.10
go1.20.10 (released 2023-10-10) includes a security fix to the net/http package.
- security: fix CVE-2023-39325 CVE-2023-44487 net/http: rapid stream resets can cause excessive work (bsc#1216109)
go1.20.9 (released 2023-10-05) includes one security fixes to the cmd/go package, as well as bug fixes to the go command and the linker.
- security: fix CVE-2023-39323 cmd/go: line directives allows arbitrary execution during build (bsc#1215985)
- cmd/link: issues with Apple's new linker in Xcode 15 beta
- Record
SUSE-SU-2023:4472-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
msft-golangAzure Linux:2 |
before 1.20.11-1 | 1.20.11-1 |
golangAzure Linux:2 |
before 1.21.6-1 | 1.21.6-1 |
golangAzure Linux:2 |
1.18.0 up to 1.21.6-1 | 1.21.6-1 |
golangAzure Linux:3 |
through 1.26.10-1 | None known |
golangAzure Linux:3 |
1.27.0 to 1.27.1-1 | None known |
golangBitnami |
before 1.20.11, 1.21.0-0 up to 1.21.4 | 1.20.111.21.4 |
golang-1.19Debian:12 |
All versions, plus listed versions 1.19.10-11.19.10-21.19.11-11.19.12-11.19.12-2 Show 7 moreShow less1.19.12-2~bpo11+11.19.12-2~bpo12+11.19.13-11.19.13-1~bpo11+11.19.13-1~bpo12+11.19.8-21.19.9-1 |
None known |
stdlibGo |
before 1.20.11, 1.21.0-0 up to 1.21.4 | 1.20.111.21.4 |
stdlibGo |
1.20.11 up to 1.20.12, 1.21.4 up to 1.21.5 | 1.20.121.21.5 |
golangMageia:8 From an advisory covering 3 CVEs |
before 1.21.5-1.mga8 | 1.21.5-1.mga8 |
Show 39 moreShow less
| Package | Affected | Fixed |
|---|---|---|
golangMageia:9 From an advisory covering 3 CVEs |
before 1.21.5-1.mga9 | 1.21.5-1.mga9 |
go1.21-opensslSUSE:Linux Enterprise Module for Development Tools 15 SP4 From an advisory covering 10 CVEs |
before 1.21.4.1-150000.1.5.1 | 1.21.4.1-150000.1.5.1 |
go1.21-opensslSUSE:Linux Enterprise Module for Development Tools 15 SP5 From an advisory covering 10 CVEs |
before 1.21.4.1-150000.1.5.1 | 1.21.4.1-150000.1.5.1 |
go1.21-opensslopenSUSE:Leap 15.4 From an advisory covering 10 CVEs |
before 1.21.4.1-150000.1.5.1 | 1.21.4.1-150000.1.5.1 |
go1.21-opensslopenSUSE:Leap 15.5 From an advisory covering 10 CVEs |
before 1.21.4.1-150000.1.5.1 | 1.21.4.1-150000.1.5.1 |
go1.20SUSE:Linux Enterprise Module for Development Tools 15 SP4 From an advisory covering 2 CVEs |
before 1.20.11-150000.1.32.1 | 1.20.11-150000.1.32.1 |
go1.20SUSE:Linux Enterprise Module for Development Tools 15 SP5 From an advisory covering 2 CVEs |
before 1.20.11-150000.1.32.1 | 1.20.11-150000.1.32.1 |
go1.20openSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 1.20.11-150000.1.32.1 | 1.20.11-150000.1.32.1 |
go1.20openSUSE:Leap 15.5 From an advisory covering 2 CVEs |
before 1.20.11-150000.1.32.1 | 1.20.11-150000.1.32.1 |
go1.21SUSE:Linux Enterprise Module for Development Tools 15 SP4 From an advisory covering 2 CVEs |
before 1.21.4-150000.1.15.1 | 1.21.4-150000.1.15.1 |
go1.21SUSE:Linux Enterprise Module for Development Tools 15 SP5 From an advisory covering 2 CVEs |
before 1.21.4-150000.1.15.1 | 1.21.4-150000.1.15.1 |
go1.21openSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 1.21.4-150000.1.15.1 | 1.21.4-150000.1.15.1 |
go1.21openSUSE:Leap 15.5 From an advisory covering 2 CVEs |
before 1.21.4-150000.1.15.1 | 1.21.4-150000.1.15.1 |
go1.20-opensslSUSE:Linux Enterprise Module for Development Tools 15 SP4 From an advisory covering 5 CVEs |
before 1.20.11.1-150000.1.14.1 | 1.20.11.1-150000.1.14.1 |
go1.20-opensslSUSE:Linux Enterprise Module for Development Tools 15 SP5 From an advisory covering 5 CVEs |
before 1.20.11.1-150000.1.14.1 | 1.20.11.1-150000.1.14.1 |
go1.20-opensslopenSUSE:Leap 15.4 From an advisory covering 5 CVEs |
before 1.20.11.1-150000.1.14.1 | 1.20.11.1-150000.1.14.1 |
go1.20-opensslopenSUSE:Leap 15.5 From an advisory covering 5 CVEs |
before 1.20.11.1-150000.1.14.1 | 1.20.11.1-150000.1.14.1 |
golang-1.10Ubuntu:14.04:LTS |
All versions, plus listed versions 1.10.4-2ubuntu1~14.04.1 |
None known |
golang-1.10Ubuntu:16.04:LTS |
All versions, plus listed versions 1.10.4-2ubuntu1~16.04.11.10.4-2ubuntu1~16.04.2 |
None known |
golang-1.6Ubuntu:16.04:LTS |
All versions, plus listed versions 1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5 Show 5 moreShow less1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4 |
None known |
golang-1.13Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.13.8-1ubuntu1~16.04.21.13.8-1ubuntu1~16.04.31.13.8-1ubuntu1~16.04.3+esm21.13.8-1ubuntu1~16.04.3+esm3 |
None known |
golang-1.18Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.18.1-1ubuntu1~16.04.61.18.1-1ubuntu1~16.04.6+esm1 |
None known |
golang-1.10Ubuntu:18.04:LTS |
All versions, plus listed versions 1.10~rc1-11.10~rc1-1ubuntu11.10~rc1-2ubuntu11.10~rc2-1ubuntu11.10-1ubuntu11.10.1-1ubuntu21.10.4-2ubuntu1~18.04.11.10.4-2ubuntu1~18.04.2 |
None known |
golang-1.13Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.13.8-1ubuntu1~18.04.21.13.8-1ubuntu1~18.04.31.13.8-1ubuntu1~18.04.41.13.8-1ubuntu1~18.04.4+esm1 |
None known |
golang-1.16Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.16.2-0ubuntu1~18.04.21.16.2-0ubuntu1~18.04.2+esm1 |
None known |
golang-1.18Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.18.1-1ubuntu1~18.04.31.18.1-1ubuntu1~18.04.41.18.1-1ubuntu1~18.04.4+esm1 |
None known |
golang-1.8Ubuntu:18.04:LTS |
All versions, plus listed versions 1.8.3-2ubuntu11.8.3-2ubuntu1.18.04.1 |
None known |
golang-1.9Ubuntu:18.04:LTS |
All versions, plus listed versions 1.9.1-2ubuntu11.9.2-1ubuntu11.9.2-3ubuntu11.9.3-1ubuntu11.9.4-1ubuntu1 |
None known |
golang-1.13Ubuntu:20.04:LTS |
All versions, plus listed versions 1.13.1-1ubuntu11.13.3-1ubuntu11.13.4-1ubuntu11.13.5-1ubuntu11.13.6-1ubuntu1 Show 5 moreShow less1.13.6-2ubuntu11.13.7-1ubuntu11.13.8-1ubuntu11.13.8-1ubuntu1.11.13.8-1ubuntu1.2 |
None known |
golang-1.14Ubuntu:20.04:LTS |
All versions, plus listed versions 1.14~beta1-11.14~beta1-21.14~rc1-11.14-11.14.1-1 Show 4 moreShow less1.14.2-11.14.2-1ubuntu11.14.3-2ubuntu2~20.04.11.14.3-2ubuntu2~20.04.2 |
None known |
golang-1.16Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.16.2-0ubuntu1~20.041.16.2-0ubuntu1~20.04.11.16.2-0ubuntu1~20.04.1+esm1 |
None known |
golang-1.18Ubuntu:20.04:LTS |
All versions, plus listed versions 1.18.1-1ubuntu1~20.04.11.18.1-1ubuntu1~20.04.21.18.1-1ubuntu1~20.04.3 |
None known |
golang-1.17Ubuntu:22.04:LTS |
All versions, plus listed versions 1.17-1ubuntu21.17.3-1ubuntu11.17.3-1ubuntu21.17.13-3ubuntu11.17.13-3ubuntu1.21.17.13-3ubuntu1.3 |
None known |
golang-1.18Ubuntu:22.04:LTS |
All versions, plus listed versions 1.18~beta1-0ubuntu11.18~beta2-1ubuntu11.18~beta2-1ubuntu21.18~rc1-1ubuntu11.18-1ubuntu1 Show 4 moreShow less1.18.1-1ubuntu11.18.1-1ubuntu1.11.18.1-1ubuntu1.21.18.1-1ubuntu1.3 |
None known |
golang-1.13Ubuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.13.8-1ubuntu21.13.8-1ubuntu2.22.04.11.13.8-1ubuntu2.22.04.1+esm11.13.8-1ubuntu2.22.04.2 |
None known |
go1.20openSUSE:Tumbleweed |
before 1.20.11-1.1 | 1.20.11-1.1 |
go1.21openSUSE:Tumbleweed |
before 1.21.4-1.1 | 1.21.4-1.1 |
traefikopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 2.10.7-1.1 | 2.10.7-1.1 |
traefik2openSUSE:Tumbleweed From an advisory covering 15 CVEs |
before 2.11.5-1.1 | 2.11.5-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-45283 is a high vulnerability (CVSS 7.5) in Go Standard Library Path/filepath, published November 8, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.32%, the 88th percentile. Fixed in msft-golang 1.20.11-1.
References
go.dev/issue/63713
groups.google.com/g/golang-announce/c/4tU8LZfBFkY
Show 54 moreShow less
pkg.go.dev/vuln/GO-2023-2185
openwall.com/lists/oss-security/2023/12/05/2
security.netapp.com/advisory/ntap-20231214-0008
nvd.nist.gov/vuln/detail/CVE-2023-45283
github.com/advisories/GHSA-vvjp-q62m-2vph
security-tracker.debian.org/tracker/CVE-2023-45283
advisories.mageia.org/MGASA-2023-0349.html
bugs.mageia.org/show_bug.cgi?id=32622
suse.com/support/update/announcement/2023/suse-su-20234469-1
bugzilla.suse.com/1212475
ubuntu.com/security/CVE-2023-45283
cve.org/CVERecord?id=CVE-2023-45283