{"id":"CVE-2023-45285","aliases":["ALSA-2024:0887","ALSA-2024:1131","AZL-32101","AZL-32103","AZL-37323","AZL-37438","AZL-79014","AZL-98985","BELL-CVE-2023-45285","BIT-golang-2023-45285","DEBIAN-CVE-2023-45285","EUVD-2023-49586","GHSA-5f94-vhjq-rpg8","GO-2023-2383","MGASA-2023-0349","OESA-2023-1935","RHSA-2024:0887","RHSA-2024:1041","RHSA-2024:1131","SUSE-SU-2023:4708-1","SUSE-SU-2023:4709-1","SUSE-SU-2023:4930-1","SUSE-SU-2023:4931-1","UBUNTU-CVE-2023-45285","USN-6574-1","openSUSE-SU-2024:13491-1","openSUSE-SU-2024:13492-1"],"status":"published","title":"Command 'go get' may unexpectedly fallback to insecure git in cmd/go","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01137,"percentile":0.66779,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-12-06T00:00:00Z","modified":"2026-10-29T11:32:00Z","fixes":[{"ecosystem":"Azure Linux:2","package":"golang","fixed_in":["1.21.6-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"msft-golang","fixed_in":["1.22.3-1."],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"go","fixed_in":["1.21.7-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"go","fixed_in":["1.21.5-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"go","fixed_in":["1.21.7-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"go","fixed_in":["1.21.5-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.20.12","1.21.5"],"sources":["osv"]},{"ecosystem":"Go","package":"toolchain","fixed_in":["1.20.12","1.21.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.20","fixed_in":["1.20.3-1ubuntu0.1~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.21","fixed_in":["1.21.1-1~ubuntu20.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.20","fixed_in":["1.20.3-1ubuntu0.1~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.21","fixed_in":["1.21.1-1~ubuntu22.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-1.module_el8.9.0+3642+43318da8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-1.module_el8.9.0+3728+f1d47c6f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-2.module_el8.9.0+3728+f1d47c6f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-2.module_el8.9.0+3728+f1d47c6f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-2.module_el8.9.0+3728+f1d47c6f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-2.module_el8.9.0+3728+f1d47c6f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-2.module_el8.9.0+3728+f1d47c6f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-2.module_el8.9.0+3728+f1d47c6f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-1.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-1.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-1.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-1.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-1.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-1.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-1.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.0"},{"fixed":"1.21.6-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"msft-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-1."}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0"},{"fixed":"1.21.6-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.6-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.25.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.7-r0"},{"fixed":"1.21.7-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.5-r2"},{"fixed":"1.21.5-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.7-r0"},{"fixed":"1.21.7-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.5-r2"},{"fixed":"1.21.5-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.20.12"},{"introduced":"1.21.0-0"},{"fixed":"1.21.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.10-1","1.19.10-2","1.19.11-1","1.19.12-1","1.19.12-2","1.19.12-2~bpo11+1","1.19.12-2~bpo12+1","1.19.13-1","1.19.13-1~bpo11+1","1.19.13-1~bpo12+1","1.19.8-2","1.19.9-1"]},{"source":"osv","ecosystem":"Go","package":"toolchain","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.20.12"},{"introduced":"1.21.0-0"},{"fixed":"1.21.5"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-37.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-37.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-37.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-26.oe2203sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-26.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-26.oe2203sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.2-1.module+el8.9.0+18926+5193682d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.2-1.module+el8.9.0+18926+5193682d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.2-1.module+el8.9.0+18926+5193682d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.12-1.module+el8.9.0+21033+5795bdf6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.12-2.module+el8.9.0+21033+5795bdf6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.12-2.module+el8.9.0+21033+5795bdf6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.12-2.module+el8.9.0+21033+5795bdf6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.12-2.module+el8.9.0+21033+5795bdf6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.12-2.module+el8.9.0+21033+5795bdf6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.12-2.module+el8.9.0+21033+5795bdf6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.13-5.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.13-5.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.13-5.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.13-5.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.13-5.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.13-5.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2023::el7","package":"go-toolset-1.19-golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.13-5.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.12-1.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.12-1.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.12-1.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.12-1.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.12-1.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.12-1.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.12-1.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-150000.1.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-150000.1.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-150000.1.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-150000.1.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150000.1.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150000.1.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150000.1.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150000.1.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12.1-150000.1.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12.1-150000.1.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12.1-150000.1.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.20-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12.1-150000.1.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5.1-150000.1.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5.1-150000.1.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5.1-150000.1.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.21-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5.1-150000.1.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-1ubuntu0.1~20.04.1"}]}],"versions":["1.20.3-1ubuntu0.1~20.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-1~ubuntu20.04.2"}]}],"versions":["1.21.1-1~ubuntu20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-1ubuntu0.1~22.04.1"}]}],"versions":["1.20.3-1ubuntu0.1~22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-1~ubuntu22.04.2"}]}],"versions":["1.21.1-1~ubuntu22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-1ubuntu0.1~20.04.1"}]}],"versions":["1.20.3-1ubuntu0.1~20.04"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-1~ubuntu20.04.2"}]}],"versions":["1.21.1-1~ubuntu20.04.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-1ubuntu0.1~22.04.1"}]}],"versions":["1.20.3-1ubuntu0.1~22.04"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-1~ubuntu22.04.2"}]}],"versions":["1.21.1-1~ubuntu22.04.1"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.12-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-1.1"}]}],"bundled":3}],"products":[{"vendor":"go toolchain","product":"cmd/go"},{"vendor":"golang","product":"go"}],"references":[{"url":"https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ","tags":["x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://go.dev/issue/63845","tags":["x_transferred","Issue Tracking","Vendor Advisory","advisory","web","report"]},{"url":"https://go.dev/cl/540257","tags":["x_transferred","Patch","fix","web"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2383","tags":["x_transferred","Patch","Vendor Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G/","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45285","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5f94-vhjq-rpg8"},{"url":"https://access.redhat.com/errata/RHSA-2024:0887","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39326","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45285","tags":["report"]},{"url":"https://bugzilla.redhat.com/2253323","tags":["report"]},{"url":"https://bugzilla.redhat.com/2253330","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-0887.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1131","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-1131.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-45285","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2023-9","tags":["advisory"]},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45285.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-45285","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0349.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32622","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/12/05/2","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39326","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253330","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0887.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39326","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2382","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45285","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1041","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1041.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1131.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234708-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206346","tags":["report"]},{"url":"https://bugzilla.suse.com/1216943","tags":["report"]},{"url":"https://bugzilla.suse.com/1217833","tags":["report"]},{"url":"https://bugzilla.suse.com/1217834","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45285","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234709-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1212475","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234930-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234931-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-45285","tags":["report"]},{"url":"https://github.com/golang/go/commit/23c943e5296c6fa3a6f9433bd929306c4dbf2aa3","tags":["report"]},{"url":"https://github.com/golang/go/commit/46bc33819ac86a9596b8059235842f0e0c7469bd","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6574-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-39318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-44487","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-45285","title":"Command 'go get' may unexpectedly fallback to insecure git in cmd/go","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","status":"published","published":"2023-12-06T16:27:55.521Z","modified":"2025-02-13T17:14:00.033Z","updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-49586","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","status":"published","published":"2023-12-06T16:27:55Z","modified":"2025-02-13T17:14:00Z","updated_at":"2026-11-03T00:03:48.562419Z"}],"ghsa":[{"id":"GHSA-5f94-vhjq-rpg8","title":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure ...","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","status":"published","published":"2023-12-06T18:31:05Z","modified":"2024-01-20T06:30:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T14:55:27.310113Z"}],"nvd":[{"id":"CVE-2023-45285","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","status":"published","published":"2023-12-06T17:15:07.32Z","modified":"2026-06-17T06:28:35.207Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:08:54.010507Z"}],"osv":[{"id":"AZL-32101","title":"CVE-2023-45285 affecting package golang for versions less than 1.21.6-1","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","status":"published","published":"2023-12-06T17:15:07Z","modified":"2026-04-21T04:26:39.657579Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-32103","title":"CVE-2023-45285 affecting package msft-golang for versions less than 1.22.3-1.","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","status":"published","published":"2023-12-06T17:15:07Z","modified":"2026-04-21T04:26:40.212368Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-37323","title":"CVE-2023-45285 affecting package golang for versions less than 1.21.6-1","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","status":"published","published":"2023-12-06T17:15:07Z","modified":"2026-04-21T04:28:15.694498Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-37438","title":"CVE-2023-45285 affecting package golang for versions less than 1.21.6-1","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","status":"published","published":"2023-12-06T17:15:07Z","modified":"2026-04-21T04:28:20.16701Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-79014","title":"CVE-2023-45285 affecting package golang 1.25.7-1","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","status":"published","published":"2023-12-06T17:15:07Z","modified":"2026-04-21T04:34:35.732739Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"AZL-98985","title":"CVE-2023-45285 affecting package golang 1.27.1-1","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","status":"published","published":"2023-12-06T17:15:07Z","modified":"2026-09-16T06:39:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BELL-CVE-2023-45285","status":"published","published":"2023-12-06T17:15:00Z","modified":"2026-01-26T09:35:32.471389Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"DEBIAN-CVE-2023-45285","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","status":"published","published":"2023-12-06T17:15:07.32Z","modified":"2026-10-26T18:02:49.227557982Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"OESA-2023-1935","title":"golang security update","description":".\r\n\r\nSecurity Fix(es):\r\n\r\nA malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.(CVE-2023-39326)\r\n\r\nUsing go get to fetch a module with the \u0026quot;.git\u0026quot; suffix may unexpectedly fallback to the insecure \u0026quot;git://\u0026quot; protocol if the module is unavailable via the secure \u0026quot;https://\u0026quot; and \u0026quot;git+ssh://\u0026quot; protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).(CVE-2023-45285)","status":"published","published":"2023-12-22T11:06:23Z","modified":"2026-08-18T01:18:06.658050577Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2024:0887","title":"Red Hat Security Advisory: go-toolset:rhel8 security update","status":"published","published":"2024-10-21T18:43:52Z","modified":"2026-10-18T10:02:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:1041","title":"Red Hat Security Advisory: go-toolset-1.19-golang security update","status":"published","published":"2024-09-30T15:50:59Z","modified":"2026-10-18T10:02:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1131","title":"Red Hat Security Advisory: golang security update","status":"published","published":"2024-09-30T15:51:18Z","modified":"2026-10-18T10:02:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"UBUNTU-CVE-2023-45285","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","status":"published","published":"2023-12-06T00:00:00Z","modified":"2026-02-04T03:09:30.038688Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2024:0887","title":"Moderate: go-toolset:rhel8 security update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)\n* golang: cmd/go: Protocol Fallback when fetching modules (CVE-2023-45285)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-02-20T00:00:00Z","modified":"2026-10-29T11:01:32.105645711Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2024:1131","title":"Moderate: golang security update","description":"The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)\n* golang: cmd/go: Protocol Fallback when fetching modules (CVE-2023-45285)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-03-05T00:00:00Z","modified":"2026-10-29T11:32:00.702164995Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"BIT-golang-2023-45285","title":"Command 'go get' may unexpectedly fallback to insecure git in cmd/go","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","status":"published","published":"2024-03-06T10:52:37.296Z","modified":"2026-09-08T08:47:49.252462494Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"CVE-2023-45285","title":"Command 'go get' may unexpectedly fallback to insecure git in cmd/go","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","status":"published","published":"2023-12-06T16:27:55.521Z","modified":"2026-10-28T02:30:22.61191699Z","updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"GO-2023-2383","title":"Command 'go get' may unexpectedly fallback to insecure git in cmd/go","description":"Using go get to fetch a module with the \".git\" suffix may unexpectedly fallback to the insecure \"git://\" protocol if the module is unavailable via the secure \"https://\" and \"git+ssh://\" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).","status":"published","published":"2023-12-06T16:22:51Z","modified":"2026-02-04T02:22:56.854538Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"MGASA-2023-0349","title":"Updated golang packages fix security vulnerabilities","description":"Update to upstream golang 1.21.5 to fix CVE-2023-39326 and\nCVE-2023-4528[35]\nIn Mageia 8, this update also allows build nodes to build docker stack\n","status":"published","published":"2023-12-17T22:40:49Z","modified":"2026-04-16T04:41:58.043222681Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13491-1","title":"go1.20-1.20.12-1.1 on GA media","description":"These are all security issues fixed in the go1.20-1.20.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:33:32.323787Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13492-1","title":"go1.21-1.21.5-1.1 on GA media","description":"These are all security issues fixed in the go1.21-1.21.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:27:44.995614Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:4708-1","title":"Security update for go1.20","description":"This update for go1.20 fixes the following issues:\n\nUpdate to go1.20.12:\n\n- CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme (bsc#1217834).\n- CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 (bsc#1216943).\n- CVE-2023-39326: net/http: limit chunked data overhead (bsc#1217833).\n- cmd/compile: internal compiler error: panic during prove while compiling: unexpected induction with too many parents\n- cmd/go: TestScript/mod_get_direct fails with 'Filename too long' on Windows\n","status":"published","published":"2023-12-11T09:44:44Z","modified":"2026-02-04T02:25:25.191567Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4709-1","title":"Security update for go1.21","description":"This update for go1.21 fixes the following issues:\n\nUpdate to go1.21.5:\n\n- CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme (bsc#1217834).\n- CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 (bsc#1216943).\n- CVE-2023-39326: net/http: limit chunked data overhead (bsc#1217833).\n- cmd/go: go mod download needs to support toolchain upgrades\n- cmd/compile: invalid pointer found on stack when compiled with -race\n- os: NTFS deduped file changed from regular to irregular\n- net: TCPConn.ReadFrom hangs when io.Reader is TCPConn or UnixConn, Linux kernel \u003c 5.1\n- cmd/compile: internal compiler error: panic during prove while compiling: unexpected induction with too many parents\n- syscall: TestOpenFileLimit unintentionally runs on non-Unix platforms\n- runtime: self-deadlock on mheap_.lock\n- crypto/rand: Legacy RtlGenRandom use on Windows\n","status":"published","published":"2023-12-11T09:45:17Z","modified":"2026-02-04T04:12:52.896294Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4930-1","title":"Security update for go1.20-openssl","description":"This update for go1.20-openssl fixes the following issues:\n\nUpdate to version 1.20.12.1:\n\n- CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme (bsc#1217834).\n- CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 (bsc#1216943).\n- CVE-2023-39326: net/http: limit chunked data overhead (bsc#1217833).\n- cmd/compile: internal compiler error: panic during prove while compiling: unexpected induction with too many parents\n- cmd/go: TestScript/mod_get_direct fails with 'Filename too long' on Windows\n","status":"published","published":"2023-12-20T14:25:22Z","modified":"2026-02-04T02:30:33.012772Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4931-1","title":"Security update for go1.21-openssl","description":"This update for go1.21-openssl fixes the following issues:\n\nUpdate to version 1.21.5.1:\n\n- CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme (bsc#1217834).\n- CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 (bsc#1216943).\n- CVE-2023-39326: net/http: limit chunked data overhead (bsc#1217833).\n- cmd/go: go mod download needs to support toolchain upgrades\n- cmd/compile: invalid pointer found on stack when compiled with -race\n- os: NTFS deduped file changed from regular to irregular\n- net: TCPConn.ReadFrom hangs when io.Reader is TCPConn or UnixConn, Linux kernel \u003c 5.1\n- cmd/compile: internal compiler error: panic during prove while compiling: unexpected induction with too many parents\n- syscall: TestOpenFileLimit unintentionally runs on non-Unix platforms\n- runtime: self-deadlock on mheap_.lock\n- crypto/rand: Legacy RtlGenRandom use on Windows\n","status":"published","published":"2023-12-20T14:25:49Z","modified":"2026-02-04T02:42:28.566516Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"USN-6574-1","title":"Go vulnerabilities","description":"Takeshi Kaneko discovered that Go did not properly handle comments and\nspecial tags in the script context of html/template module. An attacker\ncould possibly use this issue to inject Javascript code and perform a cross\nsite scripting attack. This issue only affected Go 1.20 in Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-39318, CVE-2023-39319)\n\nIt was discovered that Go did not properly validate the \"//go:cgo_\"\ndirectives during compilation. An attacker could possibly use this issue to\ninject arbitrary code during compile time. (CVE-2023-39323)\n\nIt was discovered that Go did not limit the number of simultaneously\nexecuting handler goroutines in the net/http module. An attacker could\npossibly use this issue to cause a panic resulting into a denial of service.\n(CVE-2023-39325, CVE-2023-44487)\n\nIt was discovered that the Go net/http module did not properly validate the\nchunk extensions reading from a request or response body. An attacker could\npossibly use this issue to read sensitive information. (CVE-2023-39326)\n\nIt was discovered that Go did not properly validate the insecure \"git://\"\nprotocol when using go get to fetch a module with the \".git\" suffix. An\nattacker could possibly use this issue to bypass secure protocol checks.\n(CVE-2023-45285)\n","status":"published","published":"2024-01-11T05:30:24Z","modified":"2026-04-27T17:17:26.183491616Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}