CVE-2023-45285

Command 'go get' may unexpectedly fallback to insecure git in cmd/go

published December 6, 2023

CVSS
—
EPSS
1%
Percentile
66.3
In the wild
Unconfirmed
What it is

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01137 · 66.3th percentile
Published
2023-12-06T16:27Z
EPSS history
Timeline
  • 06 DEC 16:27Z
    Command 'go get' may unexpectedly fallback to insecure git in cmd/go
    cvelistv5