CVE-2023-45284: Incorrect detection of reserved device names on Windows in path/filepath
First published: Thu Nov 09 2023(Updated: )
Golang Go could provide weaker than expected security, caused by the failure to correctly detect reserved device names in some cases by the IsLocal function in the filepath package. An attacker could exploit this vulnerability to report "COM1", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3 as local.
Credit: security@golang.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Any of | ||
| Golang | <1.20.11 | |
| Golang | >=1.21.0-0<1.21.4 | |
| Microsoft Windows Operating System | ||
| IBM Rational Team Concert | <=1.0.0-1.0.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-45284?
CVE-2023-45284 is a vulnerability that affects the path/filepath package in Golang Go.
What is the severity of CVE-2023-45284?
CVE-2023-45284 has a severity of medium, with a severity value of 5.3.
How does CVE-2023-45284 affect Golang Go?
CVE-2023-45284 affects Golang Go versions up to 1.20.11 and versions 1.21.0-0 to 1.21.4.
How can I fix CVE-2023-45284?
To fix CVE-2023-45284, update Golang Go to a version that is not vulnerable, such as version 1.20.12 or 1.21.5.
Where can I find more information about CVE-2023-45284?
You can find more information about CVE-2023-45284 in the references provided: [Link 1](https://go.dev/issue/63713), [Link 2](https://go.dev/cl/540277), [Link 3](https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY).
- agent/references
- agent/type
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/last-modified-date
- agent/source
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/ibm-support
- source/IBM
- vendor/golang
- canonical/golang
- version/golang/1.21.0-0
- vendor/microsoft
- canonical/microsoft windows operating system
- vendor/ibm
- canonical/ibm rational team concert
- version/ibm rational team concert/1.0.0-1.0.5