CVE-2023-45285

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
Go toolchain	cmd/go	< 1.20.12; >= 1.21.0-0, < 1.21.5

References

https://go.dev/cl/540257Patch
https://go.dev/issue/63845Issue Tracking, Vendor Advisory
https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJMailing List, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G/
https://pkg.go.dev/vuln/GO-2023-2383Patch, Vendor Advisory
https://go.dev/cl/540257Patch
https://go.dev/issue/63845Issue Tracking, Vendor Advisory
https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJMailing List, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G/
https://pkg.go.dev/vuln/GO-2023-2383Patch, Vendor Advisory

Timeline

Published: Dec 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-452865.9A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Poo CVE-2023-452877.5Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent t CVE-2023-452887.5An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Mai CVE-2023-452894.3When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not for CVE-2023-452906.5When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue CVE-2023-452925.3When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a n CVE-2023-45309.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Turna Advertising Administration Panel CVE-2023-453038.8ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker sup CVE-2023-45319.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestav Software E-commerce Software al CVE-2023-453119.8fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute ar CVE-2023-453128.8In the mtproto_proxy (aka MTProto proxy) component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secur CVE-2023-453155.5Improper initialization in some Intel(R) Power Gadget software for Windwos all versions may allow an authenticated user to potentially enabl