UBUNTU-CVE-2023-45285
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
02 / AFFECTED SOFTWARE
Affected packages
1 explicit affected versions
1 explicit affected versions
1 explicit affected versions
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
05 / REFERENCES
Further evidence
- https://github.com/golang/go/commit/23c943e5296c6fa3a6f9433bd929306c4dbf2aa3
- https://github.com/golang/go/commit/46bc33819ac86a9596b8059235842f0e0c7469bd
- https://go.dev/issue/63845
- https://ubuntu.com/security/CVE-2023-45285
- https://ubuntu.com/security/notices/USN-6574-1
- https://www.cve.org/CVERecord?id=CVE-2023-45285