CVE-2023-45285: Command 'go get' may unexpectedly fallback to insecure git in cmd/go
Command 'go get' may unexpectedly fallback to insecure git in cmd/go
Other sources
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.20.12 - Upgrade
Upgrade
redhat/golang 1.21.0to a version that resolves this vulnerability.Fixed in 0 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.21.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.21.6-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.22.3-1.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-45285?
CVE-2023-45285 has a severity rating that indicates a moderate security risk due to potential fallback to the insecure 'git://' protocol.
How do I fix CVE-2023-45285?
To fix CVE-2023-45285, upgrade to Go version 1.20.12 or later, and ensure you are not using vulnerable package versions.
Which versions of Go are affected by CVE-2023-45285?
CVE-2023-45285 affects Go versions 1.15, 1.19, and versions up to 1.20.12.
What happens if I use a module with the '.git' suffix in Go while affected by CVE-2023-45285?
Using a module with the '.git' suffix may cause the system to fall back to the insecure 'git://' protocol if the module is unavailable through secure protocols.
Is GOINSECURE relevant for CVE-2023-45285?
Yes, GOINSECURE is not relevant for CVE-2023-45285 as it can still fallback to 'git://' regardless of this setting.