{"id":"CVE-2023-45284","aliases":["AZL-37425","AZL-37513","AZL-78944","AZL-98742","BIT-golang-2023-45284","DEBIAN-CVE-2023-45284","EUVD-2023-49585","GHSA-rq3x-83w4-p28c","GO-2023-2186","SUSE-SU-2023:4469-1","SUSE-SU-2023:4470-1","SUSE-SU-2023:4471-1","SUSE-SU-2023:4472-1","SUSE-SU-2023:4708-1","SUSE-SU-2023:4709-1","SUSE-SU-2023:4930-1","SUSE-SU-2023:4931-1","UBUNTU-CVE-2023-45284","openSUSE-SU-2024:13491-1","openSUSE-SU-2024:13492-1","openSUSE-SU-2024:13506-1","openSUSE-SU-2024:14076-1"],"status":"published","title":"Incorrect detection of reserved device names on Windows in path/filepath","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01096,"percentile":0.65827,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-11-08T22:42:19Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:2","package":"golang","fixed_in":["1.21.6-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.20.11","1.21.4"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.20.11","1.21.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0"},{"fixed":"1.21.6-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.6-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.26.10-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.20.11"},{"introduced":"1.21.0-0"},{"fixed":"1.21.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.10-1","1.19.10-2","1.19.11-1","1.19.12-1","1.19.12-2","1.19.12-2~bpo11+1","1.19.12-2~bpo12+1","1.19.13-1","1.19.13-1~bpo11+1","1.19.13-1~bpo12+1","1.19.8-2","1.19.9-1"]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.20.11"},{"introduced":"1.21.0-0"},{"fixed":"1.21.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4.1-150000.1.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4.1-150000.1.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4.1-150000.1.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4.1-150000.1.5.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-150000.1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-150000.1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-150000.1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-150000.1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-150000.1.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-150000.1.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-150000.1.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-150000.1.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11.1-150000.1.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11.1-150000.1.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11.1-150000.1.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11.1-150000.1.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-150000.1.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-150000.1.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-150000.1.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-150000.1.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150000.1.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150000.1.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150000.1.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150000.1.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12.1-150000.1.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12.1-150000.1.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12.1-150000.1.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12.1-150000.1.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5.1-150000.1.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5.1-150000.1.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5.1-150000.1.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5.1-150000.1.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~16.04.2","1.13.8-1ubuntu1~16.04.3","1.13.8-1ubuntu1~16.04.3+esm2","1.13.8-1ubuntu1~16.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~16.04.6","1.18.1-1ubuntu1~16.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10~rc1-1","1.10~rc1-1ubuntu1","1.10~rc1-2ubuntu1","1.10~rc2-1ubuntu1","1.10-1ubuntu1","1.10.1-1ubuntu2","1.10.4-2ubuntu1~18.04.1","1.10.4-2ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~18.04.2","1.13.8-1ubuntu1~18.04.3","1.13.8-1ubuntu1~18.04.4","1.13.8-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~18.04.2","1.16.2-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~18.04.3","1.18.1-1ubuntu1~18.04.4","1.18.1-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.1-1ubuntu1","1.13.3-1ubuntu1","1.13.4-1ubuntu1","1.13.5-1ubuntu1","1.13.6-1ubuntu1","1.13.6-2ubuntu1","1.13.7-1ubuntu1","1.13.8-1ubuntu1","1.13.8-1ubuntu1.1","1.13.8-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14~beta1-1","1.14~beta1-2","1.14~rc1-1","1.14-1","1.14.1-1","1.14.2-1","1.14.2-1ubuntu1","1.14.3-2ubuntu2~20.04.1","1.14.3-2ubuntu2~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~20.04","1.16.2-0ubuntu1~20.04.1","1.16.2-0ubuntu1~20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~20.04.1","1.18.1-1ubuntu1~20.04.2","1.18.1-1ubuntu1~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1","1.17.13-3ubuntu1.2","1.17.13-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18~beta1-0ubuntu1","1.18~beta2-1ubuntu1","1.18~beta2-1ubuntu2","1.18~rc1-1ubuntu1","1.18-1ubuntu1","1.18.1-1ubuntu1","1.18.1-1ubuntu1.1","1.18.1-1ubuntu1.2","1.18.1-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu2","1.13.8-1ubuntu2.22.04.1","1.13.8-1ubuntu2.22.04.1+esm1","1.13.8-1ubuntu2.22.04.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"traefik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.7-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"traefik2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.5-1.1"}]}],"bundled":15}],"products":[{"vendor":"go standard library","product":"path/filepath"},{"vendor":"golang","product":"go"}],"references":[{"url":"https://go.dev/issue/63713","tags":["x_transferred","Issue Tracking","Vendor Advisory","advisory","web","report"]},{"url":"https://go.dev/cl/540277","tags":["x_transferred","Issue Tracking","Vendor Advisory","advisory","web","fix"]},{"url":"https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY","tags":["x_transferred","Issue Tracking","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2186","tags":["x_transferred","Issue Tracking","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45284","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-rq3x-83w4-p28c"},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45284.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-45284","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234469-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1212475","tags":["report"]},{"url":"https://bugzilla.suse.com/1212667","tags":["report"]},{"url":"https://bugzilla.suse.com/1212669","tags":["report"]},{"url":"https://bugzilla.suse.com/1215084","tags":["report"]},{"url":"https://bugzilla.suse.com/1215085","tags":["report"]},{"url":"https://bugzilla.suse.com/1215086","tags":["report"]},{"url":"https://bugzilla.suse.com/1215087","tags":["report"]},{"url":"https://bugzilla.suse.com/1215090","tags":["report"]},{"url":"https://bugzilla.suse.com/1215985","tags":["report"]},{"url":"https://bugzilla.suse.com/1216109","tags":["report"]},{"url":"https://bugzilla.suse.com/1216943","tags":["report"]},{"url":"https://bugzilla.suse.com/1216944","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45284","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234470-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206346","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234471-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234472-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234708-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1217833","tags":["report"]},{"url":"https://bugzilla.suse.com/1217834","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45285","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234709-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234930-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234931-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-45284","tags":["report"]},{"url":"https://github.com/golang/go/issues/63713","tags":["report"]},{"url":"https://github.com/golang/go/commit/9e933c189ca3a84f12995b3c799364a06abc4376","tags":["report"]},{"url":"https://github.com/golang/go/commit/46fb78168596f7ce8834f528bb0eb9555c08bcae","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45284","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28869","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-45284","title":"Incorrect detection of reserved device names on Windows in path/filepath","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.","status":"published","published":"2023-11-09T16:30:15.25Z","modified":"2024-09-03T19:00:47.531Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-49585","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.","status":"published","published":"2023-11-09T16:30:15Z","modified":"2024-09-03T19:00:47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:56:05.029422Z"}],"ghsa":[{"id":"GHSA-rq3x-83w4-p28c","title":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases....","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.","status":"published","published":"2023-11-09T18:34:55Z","modified":"2023-11-26T05:04:30Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T14:55:06.358976Z"}],"nvd":[{"id":"CVE-2023-45284","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.","status":"published","published":"2023-11-09T17:15:08.813Z","modified":"2026-06-17T06:28:35.01Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:08:43.669554Z"}],"osv":[{"id":"AZL-37425","title":"CVE-2023-45284 affecting package golang for versions less than 1.21.6-1","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.","status":"published","published":"2023-11-09T17:15:08Z","modified":"2026-04-21T04:28:18.975888Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-37513","title":"CVE-2023-45284 affecting package golang for versions less than 1.21.6-1","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.","status":"published","published":"2023-11-09T17:15:08Z","modified":"2026-04-21T04:28:22.557411Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-78944","title":"CVE-2023-45284 affecting package golang 1.26.10-1","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.","status":"published","published":"2023-11-09T17:15:08Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"AZL-98742","title":"CVE-2023-45284 affecting package golang 1.27.1-1","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.","status":"published","published":"2023-11-09T17:15:08Z","modified":"2026-09-16T06:39:01Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"CVE-2023-45284","title":"Incorrect detection of reserved device names on Windows in path/filepath","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.","status":"published","published":"2023-11-09T16:30:15.25Z","modified":"2026-10-28T02:31:10.584703186Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"DEBIAN-CVE-2023-45284","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.","status":"published","published":"2023-11-09T17:15:08.813Z","modified":"2026-10-26T18:03:06.628443771Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"UBUNTU-CVE-2023-45284","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.","status":"published","published":"2023-11-09T17:15:00Z","modified":"2026-10-06T23:30:56.099027125Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"BIT-golang-2023-45284","title":"Incorrect detection of reserved device names on Windows in path/filepath","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.","status":"published","published":"2024-03-06T10:52:50.966Z","modified":"2026-09-08T08:47:49.217599256Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2023-2186","title":"Incorrect detection of reserved device names on Windows in path/filepath","description":"On Windows, The IsLocal function does not correctly detect reserved device names in some cases.\n\nReserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local.\n\nWith fix, IsLocal now correctly reports these names as non-local.","status":"published","published":"2023-11-08T22:42:19Z","modified":"2026-02-04T03:56:59.969208Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"openSUSE-SU-2024:13491-1","title":"go1.20-1.20.12-1.1 on GA media","description":"These are all security issues fixed in the go1.20-1.20.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:33:32.323787Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13492-1","title":"go1.21-1.21.5-1.1 on GA media","description":"These are all security issues fixed in the go1.21-1.21.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:27:44.995614Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13506-1","title":"traefik-2.10.7-1.1 on GA media","description":"These are all security issues fixed in the traefik-2.10.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:18.748781Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:14076-1","title":"traefik2-2.11.5-1.1 on GA media","description":"These are all security issues fixed in the traefik2-2.11.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-24T00:00:00Z","modified":"2026-02-04T03:57:47.885126Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2023:4469-1","title":"Security update for go1.21-openssl","description":"This update for go1.21-openssl fixes the following issues:\n\nUpdate to version 1.21.4.1 cut from the go1.21-openssl-fips\nbranch at the revision tagged go1.21.4-1-openssl-fips.\n\n* Update to go1.21.4\n\n\ngo1.21.4 (released 2023-11-07) includes security fixes to the\npath/filepath package, as well as bug fixes to the linker, the\nruntime, the compiler, and the go/types, net/http, and\nruntime/cgo packages.\n\n* security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)\n* spec: update unification rules\n* cmd/compile: internal compiler error: expected struct value to have type struct\n* cmd/link: split text sections for arm 32-bit\n* runtime: MADV_COLLAPSE causes production performance issues on Linux\n* go/types, x/tools/go/ssa: panic: type param without replacement encountered\n* cmd/compile: -buildmode=c-archive produces code not suitable for use in a shared object on arm64\n* net/http: http2 page fails on firefox/safari if pushing resources\n\n\nInitial package go1.21-openssl version 1.21.3.1 cut from the\ngo1.21-openssl-fips branch at the revision tagged\ngo1.21.3-1-openssl-fips.  (jsc#SLE-18320)\n\n* Go upstream merged branch dev.boringcrypto in go1.19+.\n* In go1.x enable BoringCrypto via GOEXPERIMENT=boringcrypto.\n* In go1.x-openssl enable FIPS mode (or boring mode as the\n  package is named) either via an environment variable\n  GOLANG_FIPS=1 or by virtue of booting the host in FIPS mode.\n* When the operating system is operating in FIPS mode, Go\n  applications which import crypto/tls/fipsonly limit operations\n  to the FIPS ciphersuite.\n* go1.x-openssl is delivered as two large patches to go1.x\n  applying necessary modifications from the golang-fips/go GitHub\n  project for the Go crypto library to use OpenSSL as the\n  external cryptographic library in a FIPS compliant way.\n* go1.x-openssl modifies the crypto/* packages to use OpenSSL for\n  cryptographic operations.\n* go1.x-openssl uses dlopen() to call into OpenSSL.\n* SUSE RPM packaging introduces a fourth version digit go1.x.y.z\n  corresponding to the golang-fips/go patchset tagged revision.\n* Patchset improvements can be updated independently of upstream\n  Go maintenance releases.\n","status":"published","published":"2023-11-16T17:59:49Z","modified":"2026-02-04T03:46:50.651371Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4470-1","title":"Security update for go1.20","description":"This update for go1.20 fixes the following issues:\n\ngo1.20.11 (released 2023-11-07) includes security fixes to the\npath/filepath package, as well as bug fixes to the linker and the\nnet/http package.\n\n* security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)\n* cmd/link: split text sections for arm 32-bit\n* net/http: http2 page fails on firefox/safari if pushing resources\n","status":"published","published":"2023-11-16T18:00:27Z","modified":"2026-02-04T04:22:58.643343Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4471-1","title":"Security update for go1.21","description":"This update for go1.21 fixes the following issues:\n\ngo1.21.4 (released 2023-11-07) includes security fixes to the\npath/filepath package, as well as bug fixes to the linker, the\nruntime, the compiler, and the go/types, net/http, and\nruntime/cgo packages.\n\n* security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)\n* spec: update unification rules\n* cmd/compile: internal compiler error: expected struct value to have type struct\n* cmd/link: split text sections for arm 32-bit\n* runtime: MADV_COLLAPSE causes production performance issues on Linux\n* go/types, x/tools/go/ssa: panic: type param without replacement encountered\n* cmd/compile: -buildmode=c-archive produces code not suitable for use in a shared object on arm64\n* net/http: http2 page fails on firefox/safari if pushing resources\n","status":"published","published":"2023-11-16T18:01:00Z","modified":"2026-02-04T03:46:59.517729Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4472-1","title":"Security update for go1.20-openssl","description":"This update for go1.20-openssl fixes the following issues:\n\nUpdate to version 1.20.11.1 cut from the go1.20-openssl-fips\nbranch at the revision tagged go1.20.11-1-openssl-fips.\n\n* Update to go1.20.11\n\n\ngo1.20.11 (released 2023-11-07) includes security fixes to the\npath/filepath package, as well as bug fixes to the linker and the\nnet/http package.\n\n* security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)\n* cmd/link: split text sections for arm 32-bit\n* net/http: http2 page fails on firefox/safari if pushing resources\n\n\nUpdate to version 1.20.10.1 cut from the go1.20-openssl-fips\nbranch at the revision tagged go1.20.10-1-openssl-fips.\n\n* Update to go1.20.10\n\n\ngo1.20.10 (released 2023-10-10) includes a security fix to the\nnet/http package.\n\n* security: fix CVE-2023-39325 CVE-2023-44487 net/http: rapid stream resets can cause excessive work (bsc#1216109)\n\n  \ngo1.20.9 (released 2023-10-05) includes one security fixes to the\ncmd/go package, as well as bug fixes to the go command and the\nlinker.\n\n* security: fix CVE-2023-39323 cmd/go: line directives allows arbitrary execution during build (bsc#1215985)\n* cmd/link: issues with Apple's new linker in Xcode 15 beta\n","status":"published","published":"2023-11-16T18:01:39Z","modified":"2026-02-04T02:32:54.242391Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4708-1","title":"Security update for go1.20","description":"This update for go1.20 fixes the following issues:\n\nUpdate to go1.20.12:\n\n- CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme (bsc#1217834).\n- CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 (bsc#1216943).\n- CVE-2023-39326: net/http: limit chunked data overhead (bsc#1217833).\n- cmd/compile: internal compiler error: panic during prove while compiling: unexpected induction with too many parents\n- cmd/go: TestScript/mod_get_direct fails with 'Filename too long' on Windows\n","status":"published","published":"2023-12-11T09:44:44Z","modified":"2026-02-04T02:25:25.191567Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4709-1","title":"Security update for go1.21","description":"This update for go1.21 fixes the following issues:\n\nUpdate to go1.21.5:\n\n- CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme (bsc#1217834).\n- CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 (bsc#1216943).\n- CVE-2023-39326: net/http: limit chunked data overhead (bsc#1217833).\n- cmd/go: go mod download needs to support toolchain upgrades\n- cmd/compile: invalid pointer found on stack when compiled with -race\n- os: NTFS deduped file changed from regular to irregular\n- net: TCPConn.ReadFrom hangs when io.Reader is TCPConn or UnixConn, Linux kernel \u003c 5.1\n- cmd/compile: internal compiler error: panic during prove while compiling: unexpected induction with too many parents\n- syscall: TestOpenFileLimit unintentionally runs on non-Unix platforms\n- runtime: self-deadlock on mheap_.lock\n- crypto/rand: Legacy RtlGenRandom use on Windows\n","status":"published","published":"2023-12-11T09:45:17Z","modified":"2026-02-04T04:12:52.896294Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4930-1","title":"Security update for go1.20-openssl","description":"This update for go1.20-openssl fixes the following issues:\n\nUpdate to version 1.20.12.1:\n\n- CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme (bsc#1217834).\n- CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 (bsc#1216943).\n- CVE-2023-39326: net/http: limit chunked data overhead (bsc#1217833).\n- cmd/compile: internal compiler error: panic during prove while compiling: unexpected induction with too many parents\n- cmd/go: TestScript/mod_get_direct fails with 'Filename too long' on Windows\n","status":"published","published":"2023-12-20T14:25:22Z","modified":"2026-02-04T02:30:33.012772Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4931-1","title":"Security update for go1.21-openssl","description":"This update for go1.21-openssl fixes the following issues:\n\nUpdate to version 1.21.5.1:\n\n- CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme (bsc#1217834).\n- CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 (bsc#1216943).\n- CVE-2023-39326: net/http: limit chunked data overhead (bsc#1217833).\n- cmd/go: go mod download needs to support toolchain upgrades\n- cmd/compile: invalid pointer found on stack when compiled with -race\n- os: NTFS deduped file changed from regular to irregular\n- net: TCPConn.ReadFrom hangs when io.Reader is TCPConn or UnixConn, Linux kernel \u003c 5.1\n- cmd/compile: internal compiler error: panic during prove while compiling: unexpected induction with too many parents\n- syscall: TestOpenFileLimit unintentionally runs on non-Unix platforms\n- runtime: self-deadlock on mheap_.lock\n- crypto/rand: Legacy RtlGenRandom use on Windows\n","status":"published","published":"2023-12-20T14:25:49Z","modified":"2026-02-04T02:42:28.566516Z","updated_at":"2026-11-02T15:53:53.865042Z"}]}}