CVE-2023-45285: Command 'go get' may unexpectedly fallback to insecure git in cmd/go

Modified

AliasesUBUNTU-CVE-2023-45285DEBIAN-CVE-2023-45285CGA-24g3-4232-99hx+161 more

Published 06-12-2023Last modified 13-02-2025

Vulnerability summary

CVE-2023-45285 is a high (CVSS 7.5) vulnerability in go toolchain cmd/go. EPSS estimates a 1.14% chance of exploitation in the next 30 days, higher than 66.5% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

1.14%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 101

MGASA-2023-0349 OPENSUSE-SU-2024:13491-1 OPENSUSE-SU-2024:13492-1 RHSA-2024:0887 RHSA-2024:1041 RHSA-2024:1131+94 more

Showing 100 of 102.

Timeline

06-12-2023
PublishedVulnerability first disclosed.
13-02-2025
Last modifiedVulnerability information updated.

Description

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).

CVSS metrics

3 scores · 3 sources · 1 version

v3.17.5

EPSS trend

Probability

1.14%

Chance of exploitation in the next 30 days

Percentile

67%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.14% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard80 products

aactl< 0.4.12-r5
amass< 4.2.0-r3
aws-flb-cloudwatch< 1.9.4-r6
aws-flb-firehose< 1.7.2-r6
aws-flb-kinesis< 1.10.2-r6

bank-vaults-fips< 1.20.4-r3
cass-operator< 1.18.2-r3
cass-operator-fips< 1.18.2-r1
cni-plugins< 1.4.0-r1
cni-plugins-fips< 1.4.0-r1
configmap-reload< 0.12.0-r3
configmap-reload-fips< 0.12.0-r2
configmap-reload-fips-0.11< 0.11.1-r3
cortex< 1.16.0-r1
ctop< 0.7.7-r10
dgraph< 23.1.0-r4
docker-cli< 24.0.6-r1
docker-credential-ecr-login< 0.7.1-r8
flannel-cni-plugin< 1.2.0-r5
fulcio-fips< 1.4.3-r1
gke-gcloud-auth-plugin< 0.0.2-r6
go-bindata< 3.1.3-r15
go-licenses< 1.6.0-r8
go-md2man< 2.0.3-r1
gobuster< 3.6.0-r4
gops< 0.3.28-r4
gosu< 1.17-r2
grpcurl< 1.8.9-r2
helm-push< 0.10.4-r1
hey< 0.1.4-r9
hubble-ui-backend< 0.13.3-r1
influx< 2.7.3-r8
ip-masq-agent< 2.9.3-r6
jsonnet-bundler< 0.5.1-r1
k3d< 5.6.0-r5
katib-earlystopping< 0.19.0-r31
katib-suggestion-goptuna-compatAll versions (No fix recorded)
katib-suggestion-hyperband< 0.19.0-r31
katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
katib-suggestion-nas-darts< 0.19.0-r31
katib-suggestion-nas-enas< 0.19.0-r31
katib-suggestion-optuna-enas< 0.19.0-r31
katib-suggestion-pbt-enas< 0.19.0-r31
katib-suggestion-skopt-enas< 0.19.0-r31
katib-tfevent-metricscollector< 0.19.0-r31
kind< 0.21.0-r0
kube-logging-logging-operator-4.1< 4.1.0-r3
kubernetes-csi-livenessprobe-2.10< 2.10.0-r4
kubernetes-csi-livenessprobe-fips< 2.11.0-r4
kubernetes-csi-livenessprobe-fips-2.10< 2.10.0-r4
kubernetes-dashboard-metrics-scraper< 1.0.9-r10
kubernetes-dashboard-metrics-scraper-compat< 1.0.9-r10
local-path-provisioner< 0.0.26-r2
mage< 1.15.0-r4
metrics-server< 0.6.4-r8
nats< 0.1.1-r4
nri-discovery-kubernetes< 1.7.2-r2
nsc< 2.8.5-r1
oras< 1.1.0-r4
petname< 2.11-r3
prometheus-adapter-fips-0.10< 0.10.1-r2
prometheus-beat-exporter-fips< 0.4.0-r1
prometheus-bind-exporter< 0.7.0-r5
prometheus-stackdriver-exporter< 0.14.1-r7
prometheus-statsd-exporter-fips-0.22< 0.22.8-r1
protoc-gen-go-grpc< 1.3.0-r7
render-template< 1.0.6-r1
sbom-scorecard< 0.0.7-r6
scorecard< 4.13.1-r1
slsa-verifier< 2.4.1-r1
smarter-device-manager< 1.20.11-r3
smarter-device-manager-fips< 1.20.11-r2
sonobuoy< 0.57.1-r1
sops< 3.8.1-r1
stakater-reloader-0.0.119< 0.0.119-r4
stakater-reloader-0.0.128< 0.0.128-r3
tigera-operator-1.28< 1.28.15-r2
tigera-operator-1.29< 1.29.8-r1
vertical-pod-autoscaler< 1.0.0-r2
wait-for-port< 1.0.7-r1

Show all 80

Wolfi59 products

aactl< 0.4.12-r5
amass< 4.2.0-r3
aws-flb-cloudwatch< 1.9.4-r6
aws-flb-firehose< 1.7.2-r6
aws-flb-kinesis< 1.10.2-r6

Show all 59

Ubuntu2 products

golang-1.20< 1.20.3-1ubuntu0.1~20.04.1 | < 1.20.3-1ubuntu0.1~22.04.1
golang-1.21< 1.21.1-1~ubuntu20.04.2 | < 1.21.1-1~ubuntu22.04.2

Debian1 product

golang-1.19All versions (No fix recorded)

Go1 product

toolchain≥ 1.21.0-0, < 1.21.5

Go toolchain1 product

cmd/go< 1.20.12 | ≥ 1.21.0-0, < 1.21.5

Golang1 product

go< 1.20.12 | ≥ 1.21.0-0, < 1.21.5

7 vendors · 145 products

References

12 links

groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJWEBMailing ListVendor Advisory
go.dev/issue/63845REPORTIssue TrackingVendor Advisory
go.dev/cl/540257FIXPatch
pkg.go.dev/vuln/GO-2023-2383PatchVendor Advisory
lists.fedoraproject.org/archives/…
ubuntu.com/security/CVE-2023-45285REPORT
github.com/golang/go/commit/23c943e5296c6fa3a6f9433bd929306c4dbf2aa3REPORT
github.com/golang/go/commit/46bc33819ac86a9596b8059235842f0e0c7469bdREPORT
ubuntu.com/security/notices/USN-6574-1Advisory
www.cve.org/CVERecord?id=CVE-2023-45285REPORT

Show all 12 references

security-tracker.debian.org/tracker/CVE-2023-45285Advisory
nvd.nist.gov/vuln/detail/CVE-2023-45285OvalAdvisory