{"id":"CVE-2023-45283","aliases":["AZL-31897","AZL-37397","AZL-37444","AZL-79034","AZL-98664","BIT-golang-2023-45283","DEBIAN-CVE-2023-45283","EUVD-2023-49584","GHSA-vvjp-q62m-2vph","GO-2023-2185","MGASA-2023-0349","SUSE-SU-2023:4469-1","SUSE-SU-2023:4470-1","SUSE-SU-2023:4471-1","SUSE-SU-2023:4472-1","UBUNTU-CVE-2023-45283","openSUSE-SU-2024:13406-1","openSUSE-SU-2024:13407-1","openSUSE-SU-2024:13506-1","openSUSE-SU-2024:14076-1"],"status":"published","title":"Insecure parsing of Windows paths with a \\??\\ prefix in path/filepath","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03345,"percentile":0.88758,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2023-11-08T22:42:14Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:2","package":"msft-golang","fixed_in":["1.20.11-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"golang","fixed_in":["1.21.6-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.20.11","1.21.4"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.20.11","1.21.4","1.20.12","1.21.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"go1.20","fixed_in":["1.20.11-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"go1.21","fixed_in":["1.21.4-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"msft-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.6-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0"},{"fixed":"1.21.6-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.26.10-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.20.11"},{"introduced":"1.21.0-0"},{"fixed":"1.21.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.10-1","1.19.10-2","1.19.11-1","1.19.12-1","1.19.12-2","1.19.12-2~bpo11+1","1.19.12-2~bpo12+1","1.19.13-1","1.19.13-1~bpo11+1","1.19.13-1~bpo12+1","1.19.8-2","1.19.9-1"]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.20.11"},{"introduced":"1.21.0-0"},{"fixed":"1.21.4"}]}]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"1.20.11"},{"fixed":"1.20.12"},{"introduced":"1.21.4"},{"fixed":"1.21.5"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4.1-150000.1.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4.1-150000.1.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4.1-150000.1.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4.1-150000.1.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-150000.1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-150000.1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-150000.1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-150000.1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-150000.1.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-150000.1.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-150000.1.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-150000.1.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11.1-150000.1.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11.1-150000.1.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11.1-150000.1.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11.1-150000.1.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~16.04.2","1.13.8-1ubuntu1~16.04.3","1.13.8-1ubuntu1~16.04.3+esm2","1.13.8-1ubuntu1~16.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~16.04.6","1.18.1-1ubuntu1~16.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10~rc1-1","1.10~rc1-1ubuntu1","1.10~rc1-2ubuntu1","1.10~rc2-1ubuntu1","1.10-1ubuntu1","1.10.1-1ubuntu2","1.10.4-2ubuntu1~18.04.1","1.10.4-2ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~18.04.2","1.13.8-1ubuntu1~18.04.3","1.13.8-1ubuntu1~18.04.4","1.13.8-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~18.04.2","1.16.2-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~18.04.3","1.18.1-1ubuntu1~18.04.4","1.18.1-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.1-1ubuntu1","1.13.3-1ubuntu1","1.13.4-1ubuntu1","1.13.5-1ubuntu1","1.13.6-1ubuntu1","1.13.6-2ubuntu1","1.13.7-1ubuntu1","1.13.8-1ubuntu1","1.13.8-1ubuntu1.1","1.13.8-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14~beta1-1","1.14~beta1-2","1.14~rc1-1","1.14-1","1.14.1-1","1.14.2-1","1.14.2-1ubuntu1","1.14.3-2ubuntu2~20.04.1","1.14.3-2ubuntu2~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~20.04","1.16.2-0ubuntu1~20.04.1","1.16.2-0ubuntu1~20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~20.04.1","1.18.1-1ubuntu1~20.04.2","1.18.1-1ubuntu1~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1","1.17.13-3ubuntu1.2","1.17.13-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18~beta1-0ubuntu1","1.18~beta2-1ubuntu1","1.18~beta2-1ubuntu2","1.18~rc1-1ubuntu1","1.18-1ubuntu1","1.18.1-1ubuntu1","1.18.1-1ubuntu1.1","1.18.1-1ubuntu1.2","1.18.1-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu2","1.13.8-1ubuntu2.22.04.1","1.13.8-1ubuntu2.22.04.1+esm1","1.13.8-1ubuntu2.22.04.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"traefik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.7-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"traefik2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.5-1.1"}]}],"bundled":15}],"products":[{"vendor":"go standard library","product":"internal/safefilepath"},{"vendor":"go standard library","product":"path/filepath"},{"vendor":"golang","product":"go"}],"references":[{"url":"https://go.dev/issue/63713","tags":["x_transferred","Issue Tracking","Vendor Advisory","advisory","web","report"]},{"url":"https://go.dev/cl/540277","tags":["x_transferred","Issue Tracking","Vendor Advisory","advisory","web","fix"]},{"url":"https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY","tags":["x_transferred","Issue Tracking","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"https://go.dev/issue/64028","tags":["x_transferred","web","report"]},{"url":"https://go.dev/cl/541175","tags":["x_transferred","web","fix"]},{"url":"https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ","tags":["x_transferred","web"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2185","tags":["x_transferred","Issue Tracking","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/05/2","tags":["x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20231214-0008/","tags":["x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45283","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-vvjp-q62m-2vph"},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45283.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-45283","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0349.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32622","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/12/05/2","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234469-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1212475","tags":["report"]},{"url":"https://bugzilla.suse.com/1212667","tags":["report"]},{"url":"https://bugzilla.suse.com/1212669","tags":["report"]},{"url":"https://bugzilla.suse.com/1215084","tags":["report"]},{"url":"https://bugzilla.suse.com/1215085","tags":["report"]},{"url":"https://bugzilla.suse.com/1215086","tags":["report"]},{"url":"https://bugzilla.suse.com/1215087","tags":["report"]},{"url":"https://bugzilla.suse.com/1215090","tags":["report"]},{"url":"https://bugzilla.suse.com/1215985","tags":["report"]},{"url":"https://bugzilla.suse.com/1216109","tags":["report"]},{"url":"https://bugzilla.suse.com/1216943","tags":["report"]},{"url":"https://bugzilla.suse.com/1216944","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45284","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234470-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206346","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234471-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234472-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-45283","tags":["report"]},{"url":"https://github.com/golang/go/issues/63713","tags":["report"]},{"url":"https://github.com/golang/go/commit/9e933c189ca3a84f12995b3c799364a06abc4376","tags":["report"]},{"url":"https://github.com/golang/go/commit/46fb78168596f7ce8834f528bb0eb9555c08bcae","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45283","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28869","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-45283","title":"Insecure parsing of Windows paths with a \\??\\ prefix in path/filepath","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.","status":"published","published":"2023-11-09T16:30:12.395Z","modified":"2025-02-13T17:13:59.471Z","updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-49584","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.","status":"published","published":"2023-11-09T16:30:12Z","modified":"2025-02-13T17:13:59Z","updated_at":"2026-11-03T00:03:48.562419Z"}],"ghsa":[{"id":"GHSA-vvjp-q62m-2vph","title":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path...","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name.","status":"published","published":"2023-11-09T18:34:55Z","modified":"2023-12-14T12:31:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:55:11.957073Z"}],"nvd":[{"id":"CVE-2023-45283","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.","status":"published","published":"2023-11-09T17:15:08.757Z","modified":"2026-06-17T06:28:34.863Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:43.669554Z"}],"osv":[{"id":"AZL-31897","title":"CVE-2023-45283 affecting package msft-golang for versions less than 1.20.11-1","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.","status":"published","published":"2023-11-09T17:15:08Z","modified":"2026-04-21T04:26:34.084071Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-37397","title":"CVE-2023-45283 affecting package golang for versions less than 1.21.6-1","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.","status":"published","published":"2023-11-09T17:15:08Z","modified":"2026-04-21T04:28:18.32787Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-37444","title":"CVE-2023-45283 affecting package golang for versions less than 1.21.6-1","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.","status":"published","published":"2023-11-09T17:15:08Z","modified":"2026-04-21T04:28:20.132006Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-79034","title":"CVE-2023-45283 affecting package golang 1.26.10-1","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.","status":"published","published":"2023-11-09T17:15:08Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"AZL-98664","title":"CVE-2023-45283 affecting package golang 1.27.1-1","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.","status":"published","published":"2023-11-09T17:15:08Z","modified":"2026-09-16T06:39:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"DEBIAN-CVE-2023-45283","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.","status":"published","published":"2023-11-09T17:15:08.757Z","modified":"2026-10-26T18:03:06.595700581Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"UBUNTU-CVE-2023-45283","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.","status":"published","published":"2023-11-09T17:15:00Z","modified":"2026-10-06T23:30:49.364223446Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"BIT-golang-2023-45283","title":"Insecure parsing of Windows paths with a \\??\\ prefix in path/filepath","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.","status":"published","published":"2024-03-06T10:53:03.789Z","modified":"2026-09-08T08:47:49.476730221Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"CVE-2023-45283","title":"Insecure parsing of Windows paths with a \\??\\ prefix in path/filepath","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.","status":"published","published":"2023-11-09T16:30:12.395Z","modified":"2026-10-28T02:31:06.409533712Z","updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"GO-2023-2185","title":"Insecure parsing of Windows paths with a \\??\\ prefix in path/filepath","description":"The filepath package does not recognize paths with a \\??\\ prefix as special.\n\nOn Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x.\n\nBefore fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b.\n\nSimilarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b.\n\nIn addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name.\n\nUPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.","status":"published","published":"2023-11-08T22:42:14Z","modified":"2026-02-04T02:59:25.590966Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"MGASA-2023-0349","title":"Updated golang packages fix security vulnerabilities","description":"Update to upstream golang 1.21.5 to fix CVE-2023-39326 and\nCVE-2023-4528[35]\nIn Mageia 8, this update also allows build nodes to build docker stack\n","status":"published","published":"2023-12-17T22:40:49Z","modified":"2026-04-16T04:41:58.043222681Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13406-1","title":"go1.20-1.20.11-1.1 on GA media","description":"These are all security issues fixed in the go1.20-1.20.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:29:17.529149Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13407-1","title":"go1.21-1.21.4-1.1 on GA media","description":"These are all security issues fixed in the go1.21-1.21.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:22:29.806881Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13506-1","title":"traefik-2.10.7-1.1 on GA media","description":"These are all security issues fixed in the traefik-2.10.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:18.748781Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:14076-1","title":"traefik2-2.11.5-1.1 on GA media","description":"These are all security issues fixed in the traefik2-2.11.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-24T00:00:00Z","modified":"2026-02-04T03:57:47.885126Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2023:4469-1","title":"Security update for go1.21-openssl","description":"This update for go1.21-openssl fixes the following issues:\n\nUpdate to version 1.21.4.1 cut from the go1.21-openssl-fips\nbranch at the revision tagged go1.21.4-1-openssl-fips.\n\n* Update to go1.21.4\n\n\ngo1.21.4 (released 2023-11-07) includes security fixes to the\npath/filepath package, as well as bug fixes to the linker, the\nruntime, the compiler, and the go/types, net/http, and\nruntime/cgo packages.\n\n* security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)\n* spec: update unification rules\n* cmd/compile: internal compiler error: expected struct value to have type struct\n* cmd/link: split text sections for arm 32-bit\n* runtime: MADV_COLLAPSE causes production performance issues on Linux\n* go/types, x/tools/go/ssa: panic: type param without replacement encountered\n* cmd/compile: -buildmode=c-archive produces code not suitable for use in a shared object on arm64\n* net/http: http2 page fails on firefox/safari if pushing resources\n\n\nInitial package go1.21-openssl version 1.21.3.1 cut from the\ngo1.21-openssl-fips branch at the revision tagged\ngo1.21.3-1-openssl-fips.  (jsc#SLE-18320)\n\n* Go upstream merged branch dev.boringcrypto in go1.19+.\n* In go1.x enable BoringCrypto via GOEXPERIMENT=boringcrypto.\n* In go1.x-openssl enable FIPS mode (or boring mode as the\n  package is named) either via an environment variable\n  GOLANG_FIPS=1 or by virtue of booting the host in FIPS mode.\n* When the operating system is operating in FIPS mode, Go\n  applications which import crypto/tls/fipsonly limit operations\n  to the FIPS ciphersuite.\n* go1.x-openssl is delivered as two large patches to go1.x\n  applying necessary modifications from the golang-fips/go GitHub\n  project for the Go crypto library to use OpenSSL as the\n  external cryptographic library in a FIPS compliant way.\n* go1.x-openssl modifies the crypto/* packages to use OpenSSL for\n  cryptographic operations.\n* go1.x-openssl uses dlopen() to call into OpenSSL.\n* SUSE RPM packaging introduces a fourth version digit go1.x.y.z\n  corresponding to the golang-fips/go patchset tagged revision.\n* Patchset improvements can be updated independently of upstream\n  Go maintenance releases.\n","status":"published","published":"2023-11-16T17:59:49Z","modified":"2026-02-04T03:46:50.651371Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4470-1","title":"Security update for go1.20","description":"This update for go1.20 fixes the following issues:\n\ngo1.20.11 (released 2023-11-07) includes security fixes to the\npath/filepath package, as well as bug fixes to the linker and the\nnet/http package.\n\n* security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)\n* cmd/link: split text sections for arm 32-bit\n* net/http: http2 page fails on firefox/safari if pushing resources\n","status":"published","published":"2023-11-16T18:00:27Z","modified":"2026-02-04T04:22:58.643343Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4471-1","title":"Security update for go1.21","description":"This update for go1.21 fixes the following issues:\n\ngo1.21.4 (released 2023-11-07) includes security fixes to the\npath/filepath package, as well as bug fixes to the linker, the\nruntime, the compiler, and the go/types, net/http, and\nruntime/cgo packages.\n\n* security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)\n* spec: update unification rules\n* cmd/compile: internal compiler error: expected struct value to have type struct\n* cmd/link: split text sections for arm 32-bit\n* runtime: MADV_COLLAPSE causes production performance issues on Linux\n* go/types, x/tools/go/ssa: panic: type param without replacement encountered\n* cmd/compile: -buildmode=c-archive produces code not suitable for use in a shared object on arm64\n* net/http: http2 page fails on firefox/safari if pushing resources\n","status":"published","published":"2023-11-16T18:01:00Z","modified":"2026-02-04T03:46:59.517729Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4472-1","title":"Security update for go1.20-openssl","description":"This update for go1.20-openssl fixes the following issues:\n\nUpdate to version 1.20.11.1 cut from the go1.20-openssl-fips\nbranch at the revision tagged go1.20.11-1-openssl-fips.\n\n* Update to go1.20.11\n\n\ngo1.20.11 (released 2023-11-07) includes security fixes to the\npath/filepath package, as well as bug fixes to the linker and the\nnet/http package.\n\n* security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)\n* cmd/link: split text sections for arm 32-bit\n* net/http: http2 page fails on firefox/safari if pushing resources\n\n\nUpdate to version 1.20.10.1 cut from the go1.20-openssl-fips\nbranch at the revision tagged go1.20.10-1-openssl-fips.\n\n* Update to go1.20.10\n\n\ngo1.20.10 (released 2023-10-10) includes a security fix to the\nnet/http package.\n\n* security: fix CVE-2023-39325 CVE-2023-44487 net/http: rapid stream resets can cause excessive work (bsc#1216109)\n\n  \ngo1.20.9 (released 2023-10-05) includes one security fixes to the\ncmd/go package, as well as bug fixes to the go command and the\nlinker.\n\n* security: fix CVE-2023-39323 cmd/go: line directives allows arbitrary execution during build (bsc#1215985)\n* cmd/link: issues with Apple's new linker in Xcode 15 beta\n","status":"published","published":"2023-11-16T18:01:39Z","modified":"2026-02-04T02:32:54.242391Z","updated_at":"2026-11-02T15:53:53.865042Z"}]}}