CVE-2023-45285

2023-12-0600:00:00

ubuntu.com

go language

module fetching

protocol security

module proxy

unix

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.0%

JSON

Using go get to fetch a module with the “.git” suffix may unexpectedly
fallback to the insecure “git://” protocol if the module is unavailable via
the secure “https://” and “git+ssh://” protocols, even if GOINSECURE is not
set for said module. This only affects users who are not using the module
proxy and are fetching modules directly (i.e. GOPROXY=off).

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchgolang-1.20< 1.20.3-1ubuntu0.1~20.04.1UNKNOWN
ubuntu22.04noarchgolang-1.20< 1.20.3-1ubuntu0.1~22.04.1UNKNOWN
ubuntu23.04noarchgolang-1.20< 1.20.3-1ubuntu0.2UNKNOWN
ubuntu23.10noarchgolang-1.20< 1.20.8-1ubuntu0.23.10.1UNKNOWN
ubuntu20.04noarchgolang-1.21< 1.21.1-1~ubuntu20.04.2UNKNOWN
ubuntu22.04noarchgolang-1.21< 1.21.1-1~ubuntu22.04.2UNKNOWN
ubuntu23.04noarchgolang-1.21< 1.21.1-1~ubuntu23.04.2UNKNOWN
ubuntu23.10noarchgolang-1.21< 1.21.1-1ubuntu0.23.10.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	golang-1.20	< 1.20.3-1ubuntu0.1~20.04.1	UNKNOWN
ubuntu	22.04	noarch	golang-1.20	< 1.20.3-1ubuntu0.1~22.04.1	UNKNOWN
ubuntu	23.04	noarch	golang-1.20	< 1.20.3-1ubuntu0.2	UNKNOWN
ubuntu	23.10	noarch	golang-1.20	< 1.20.8-1ubuntu0.23.10.1	UNKNOWN
ubuntu	20.04	noarch	golang-1.21	< 1.21.1-1~ubuntu20.04.2	UNKNOWN
ubuntu	22.04	noarch	golang-1.21	< 1.21.1-1~ubuntu22.04.2	UNKNOWN
ubuntu	23.04	noarch	golang-1.21	< 1.21.1-1~ubuntu23.04.2	UNKNOWN
ubuntu	23.10	noarch	golang-1.21	< 1.21.1-1ubuntu0.23.10.1	UNKNOWN