CVE-2024-45340: GOAUTH credential leak in cmd/go
Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45340?
CVE-2024-45340 has been assessed as a moderate severity vulnerability due to the risk of credential exposure.
How do I fix CVE-2024-45340?
To mitigate CVE-2024-45340, ensure proper domain segmentation for credentials in the Goauth feature and review your .netrc file configurations.
What are the potential impacts of CVE-2024-45340?
CVE-2024-45340 could allow a malicious server to access sensitive credentials, leading to unauthorized access and potential data breaches.
Which versions of Go are affected by CVE-2024-45340?
CVE-2024-45340 affects the Go programming language without specific version limitations mentioned in the vulnerability report.
Is CVE-2024-45340 specific to any particular operating system?
CVE-2024-45340 is not limited to a specific operating system, as it is related to the Go programming language's handling of credentials.