CVE-2023-45284: Incorrect detection of reserved device names on Windows in path/filepath
Golang Go could provide weaker than expected security, caused by the failure to correctly detect reserved device names in some cases by the IsLocal function in the filepath package. An attacker could exploit this vulnerability to report "COM1", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3 as local.
Other sources
Incorrect detection of reserved device names on Windows in path/filepath
— Microsoft
On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-45284?
CVE-2023-45284 is a vulnerability that affects the path/filepath package in Golang Go.
What is the severity of CVE-2023-45284?
CVE-2023-45284 has a severity of medium, with a severity value of 5.3.
How does CVE-2023-45284 affect Golang Go?
CVE-2023-45284 affects Golang Go versions up to 1.20.11 and versions 1.21.0-0 to 1.21.4.
How can I fix CVE-2023-45284?
To fix CVE-2023-45284, update Golang Go to a version that is not vulnerable, such as version 1.20.12 or 1.21.5.
Where can I find more information about CVE-2023-45284?
You can find more information about CVE-2023-45284 in the references provided: [Link 1](https://go.dev/issue/63713), [Link 2](https://go.dev/cl/540277), [Link 3](https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY).