Insecure Protocol Handling

github.com/golang/go is vulnerable to Insecure Protocol Handling. The vulnerability exists in the repoRootFromVCSPaths function of vcs.go when using go get to fetch a module with the .git suffix. It may unexpectedly fallback to the insecure git:// protocol if the module is unavailable via the secure https:// and git+ssh:// protocols, even if GOINSECURE is not set. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off), which may lead to a man-in-the-middle attack.