CVE-2023-45284: Incorrect detection of reserved device names on Windows in path/filepath

Modified

AliasesUBUNTU-CVE-2023-45284DEBIAN-CVE-2023-45284CGA-22c7-hh9g-v232+569 more

Published 09-11-2023Last modified 03-09-2024

Vulnerability summary

CVE-2023-45284 is a medium (CVSS 5.3) vulnerability in go standard library path/filepath. EPSS estimates a 1.09% chance of exploitation in the next 30 days, higher than 65.3% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

1.09%

0%100%

Low · +0.18 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 12 · Related 356

OPENSUSE-SU-2024:13491-1 OPENSUSE-SU-2024:13492-1 OPENSUSE-SU-2024:13506-1 OPENSUSE-SU-2024:14076-1 SUSE-SU-2023:4469-1 SUSE-SU-2023:4470-1+94 more

Showing 100 of 356.

Timeline

09-11-2023
PublishedVulnerability first disclosed.
03-09-2024
Last modifiedVulnerability information updated.

Description

On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

CVSS metrics

6 scores · 6 sources · 1 version

v3.15.3

EPSS trend

Probability

1.09%

Chance of exploitation in the next 30 days

Percentile

65%

Versus all other CVEs

30-day change

Increase +0.18 pp

From 0.90% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

aactlAll versions (No fix recorded)
actions-runner-controllerAll versions (No fix recorded)
amassAll versions (No fix recorded)
apkoAll versions (No fix recorded)
argo-workflowsAll versions (No fix recorded)

atlantisAll versions (No fix recorded)
aws-ebs-csi-driverAll versions (No fix recorded)
aws-efs-csi-driverAll versions (No fix recorded)
aws-flb-cloudwatchAll versions (No fix recorded)
aws-flb-firehoseAll versions (No fix recorded)
aws-flb-kinesisAll versions (No fix recorded)
aws-load-balancer-controllerAll versions (No fix recorded)
bank-vaultsAll versions (No fix recorded)
bomAll versions (No fix recorded)
boring-registryAll versions (No fix recorded)
bufAll versions (No fix recorded)
buildkitdAll versions (No fix recorded)
caddyAll versions (No fix recorded)
capslockAll versions (No fix recorded)
certificate-transparencyAll versions (No fix recorded)
cfsslAll versions (No fix recorded)
chartmuseumAll versions (No fix recorded)
cilium-cliAll versions (No fix recorded)
cloudflaredAll versions (No fix recorded)
cluster-autoscaler-1.26All versions (No fix recorded)
cluster-autoscaler-1.26-compatAll versions (No fix recorded)
cluster-autoscaler-1.27All versions (No fix recorded)
cluster-autoscaler-1.27-compatAll versions (No fix recorded)
cluster-autoscaler-1.28All versions (No fix recorded)
cluster-autoscaler-1.28-compatAll versions (No fix recorded)
cluster-proportional-autoscalerAll versions (No fix recorded)
cni-pluginsAll versions (No fix recorded)
configmap-reloadAll versions (No fix recorded)
conftestAll versions (No fix recorded)
cortexAll versions (No fix recorded)
cosignAll versions (No fix recorded)
craneAll versions (No fix recorded)
cri-toolsAll versions (No fix recorded)
crocAll versions (No fix recorded)
crossplane-provider-awsAll versions (No fix recorded)
crossplane-provider-azureAll versions (No fix recorded)
ctopAll versions (No fix recorded)
cueAll versions (No fix recorded)
dask-gatewayAll versions (No fix recorded)
dataplaneapiAll versions (No fix recorded)
delveAll versions (No fix recorded)
dexAll versions (No fix recorded)
dgraphAll versions (No fix recorded)
diveAll versions (No fix recorded)
docker-credential-acr-envAll versions (No fix recorded)
docker-credential-ecr-loginAll versions (No fix recorded)
docker-credential-gcrAll versions (No fix recorded)
dockerizeAll versions (No fix recorded)
dynamic-localpv-provisionerAll versions (No fix recorded)
eksctlAll versions (No fix recorded)
envoy-ratelimitAll versions (No fix recorded)
esbuildAll versions (No fix recorded)
etcd-3.5All versions (No fix recorded)
falcoctlAll versions (No fix recorded)
ferretdbAll versions (No fix recorded)
flannelAll versions (No fix recorded)
flannel-cni-pluginAll versions (No fix recorded)
fluxAll versions (No fix recorded)
flux-helm-controllerAll versions (No fix recorded)
flux-image-automation-controllerAll versions (No fix recorded)
flux-image-reflector-controllerAll versions (No fix recorded)
flux-kustomize-controllerAll versions (No fix recorded)
flux-notification-controllerAll versions (No fix recorded)
flux-source-controllerAll versions (No fix recorded)
fqAll versions (No fix recorded)
frpAll versions (No fix recorded)
fulcioAll versions (No fix recorded)
fuse-overlayfs-snapshotterAll versions (No fix recorded)
fzfAll versions (No fix recorded)
gcsfuseAll versions (No fix recorded)
git-lfsAll versions (No fix recorded)
gitnessAll versions (No fix recorded)
gitsignAll versions (No fix recorded)
gke-gcloud-auth-pluginAll versions (No fix recorded)
glabAll versions (No fix recorded)
go-bindataAll versions (No fix recorded)
go-licensesAll versions (No fix recorded)
go-md2manAll versions (No fix recorded)
gobusterAll versions (No fix recorded)
golangci-lintAll versions (No fix recorded)
gopsAll versions (No fix recorded)
goreleaserAll versions (No fix recorded)
gosuAll versions (No fix recorded)
govulncheckAll versions (No fix recorded)
grpc-health-probeAll versions (No fix recorded)
grpcurlAll versions (No fix recorded)
grypeAll versions (No fix recorded)
guacAll versions (No fix recorded)
haproxy-ingressAll versions (No fix recorded)
helmAll versions (No fix recorded)
helm-3All versions (No fix recorded)
helm-4All versions (No fix recorded)
helm-pushAll versions (No fix recorded)
heyAll versions (No fix recorded)
http-echoAll versions (No fix recorded)
hubbleAll versions (No fix recorded)
hubble-uiAll versions (No fix recorded)
hugoAll versions (No fix recorded)
hugo-extendedAll versions (No fix recorded)
influxAll versions (No fix recorded)
ip-masq-agentAll versions (No fix recorded)
k3dAll versions (No fix recorded)
k8sgptAll versions (No fix recorded)
k8sgpt-operatorAll versions (No fix recorded)
kafAll versions (No fix recorded)
kanikoAll versions (No fix recorded)
kargoAll versions (No fix recorded)
kindAll versions (No fix recorded)
kineAll versions (No fix recorded)
koAll versions (No fix recorded)
korAll versions (No fix recorded)
kotsAll versions (No fix recorded)
kptAll versions (No fix recorded)
kube-benchAll versions (No fix recorded)
kube-fluentd-operatorAll versions (No fix recorded)
kube-logging-operatorAll versions (No fix recorded)
kube-state-metricsAll versions (No fix recorded)
kubebuilderAll versions (No fix recorded)
kubeflow-katibAll versions (No fix recorded)
kubeflow-pipelinesAll versions (No fix recorded)
kubernetes-csi-external-provisionerAll versions (No fix recorded)
kubernetes-csi-external-resizerAll versions (No fix recorded)
kubernetes-csi-livenessprobeAll versions (No fix recorded)
kubernetes-dashboardAll versions (No fix recorded)
kubernetes-dashboard-metrics-scraperAll versions (No fix recorded)
kubernetes-dns-node-cacheAll versions (No fix recorded)
kubernetes-ingress-defaultbackendAll versions (No fix recorded)
kubescapeAll versions (No fix recorded)
kubevelaAll versions (No fix recorded)
kubewatchAll versions (No fix recorded)
kustomizeAll versions (No fix recorded)
kyverno-policy-reporterAll versions (No fix recorded)
kyverno-policy-reporter-kyverno-pluginAll versions (No fix recorded)
kyverno-policy-reporter-uiAll versions (No fix recorded)
litefsAll versions (No fix recorded)
local-path-provisionerAll versions (No fix recorded)
mageAll versions (No fix recorded)
mcAll versions (No fix recorded)
melangeAll versions (No fix recorded)
memcached-exporterAll versions (No fix recorded)
metacontrollerAll versions (No fix recorded)
metallbAll versions (No fix recorded)
metrics-serverAll versions (No fix recorded)
minifyAll versions (No fix recorded)
minioAll versions (No fix recorded)
mongo-toolsAll versions (No fix recorded)
natsAll versions (No fix recorded)
nats-serverAll versions (No fix recorded)
nerdctlAll versions (No fix recorded)
newrelic-fluent-bit-outputAll versions (No fix recorded)
newrelic-infra-operatorAll versions (No fix recorded)
newrelic-infrastructure-agentAll versions (No fix recorded)
newrelic-infrastructure-bundleAll versions (No fix recorded)
newrelic-nri-kube-eventsAll versions (No fix recorded)
newrelic-prometheus-configuratorAll versions (No fix recorded)
nfs-subdir-external-provisionerAll versions (No fix recorded)
node-problem-detector-0.8All versions (No fix recorded)
nodetaintAll versions (No fix recorded)
nri-apacheAll versions (No fix recorded)
nri-cassandraAll versions (No fix recorded)
nri-consulAll versions (No fix recorded)
nri-couchbaseAll versions (No fix recorded)
nri-discovery-kubernetesAll versions (No fix recorded)
nri-elasticsearchAll versions (No fix recorded)
nri-f5All versions (No fix recorded)
nri-haproxyAll versions (No fix recorded)
nri-jmxAll versions (No fix recorded)
nri-kafkaAll versions (No fix recorded)
nri-kubernetesAll versions (No fix recorded)
nri-memcachedAll versions (No fix recorded)
nri-mongodbAll versions (No fix recorded)
nri-mssqlAll versions (No fix recorded)
nri-mysqlAll versions (No fix recorded)
nri-nagiosAll versions (No fix recorded)
nri-nginxAll versions (No fix recorded)
nri-postgresqlAll versions (No fix recorded)
nri-prometheusAll versions (No fix recorded)
nri-rabbitmqAll versions (No fix recorded)
nri-redisAll versions (No fix recorded)
nscAll versions (No fix recorded)
nucleiAll versions (No fix recorded)
oauth2-proxyAll versions (No fix recorded)
ollamaAll versions (No fix recorded)
opentelemetry-collector-contribAll versions (No fix recorded)
orasAll versions (No fix recorded)
osv-scannerAll versions (No fix recorded)
paranoiaAll versions (No fix recorded)
petnameAll versions (No fix recorded)
policy-controllerAll versions (No fix recorded)
prometheus-adapterAll versions (No fix recorded)
prometheus-alertmanagerAll versions (No fix recorded)
prometheus-bind-exporterAll versions (No fix recorded)
prometheus-blackbox-exporterAll versions (No fix recorded)
prometheus-elasticsearch-exporterAll versions (No fix recorded)
prometheus-mongodb-exporterAll versions (No fix recorded)

Show all 200

1 vendor · 200 products · Showing 200 of 572

References

13 links

go.dev/issue/63713WEBREPORTIssue TrackingVendor Advisory
go.dev/cl/540277WEBFIXIssue TrackingVendor Advisory
groups.google.com/g/golang-announce/c/4tU8LZfBFkYREPORTWEBIssue TrackingMailing ListVendor Advisory
pkg.go.dev/vuln/GO-2023-2186WEBIssue TrackingVendor Advisory
ubuntu.com/security/CVE-2023-45284REPORT
github.com/golang/go/issues/63713REPORT
github.com/golang/go/commit/9e933c189ca3a84f12995b3c799364a06abc4376REPORT
github.com/golang/go/commit/46fb78168596f7ce8834f528bb0eb9555c08bcaeREPORT
www.cve.org/CVERecord?id=CVE-2023-45284REPORT
security-tracker.debian.org/tracker/CVE-2023-45284Advisory

Show all 13 references

pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45284.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2023-45284AdvisoryOval