CVE-2023-45285

Aliases:GO-2023-2383BIT-golang-2023-45285DEBIAN-CVE-2023-45285CGA-24g3-4232-99hxCGA-259r-6cgf-v793CGA-25hq-r6jg-hjmvCGA-2fg9-x67c-w4fcCGA-2hxq-cqfw-v487CGA-2mmx-4pmq-94x5CGA-2mwp-m62h-jgw2CGA-338f-mhhx-wxrrCGA-35rc-mhwf-vc6wCGA-389c-wx6h-43j7CGA-3cvv-hjj2-2399CGA-3qxc-8gg7-c56hCGA-436x-9pcc-r8g2CGA-48f9-43xw-fxqcCGA-49hv-vjp6-733jCGA-4mhm-347q-p9h3CGA-573q-qw9c-pfw5CGA-5cmh-c259-j6q2CGA-5cx3-4m9m-gf92CGA-5f4w-2pxc-qrcxCGA-5f62-pv72-455rCGA-5gxr-j36c-35cpCGA-5p69-j4hv-wvp9CGA-5rc6-7cvc-4cv3CGA-5x32-4mx3-6r8rCGA-622r-wj2j-mjcvCGA-636x-gp3x-f4r8CGA-694c-3qr7-9p8vCGA-6gvr-fhqr-w7f7CGA-6wx8-fm6q-2g6cCGA-7522-h4vp-f325CGA-76pj-w5x4-c8w4CGA-773g-3xf9-3x49CGA-7gf3-v52c-6v2hCGA-7pw4-pxqv-m35cCGA-7xfg-vwwv-3j4cCGA-864p-34vp-p59fCGA-994p-7p52-73fqCGA-9c79-mw6w-75m8CGA-9hm4-fq84-7hfcCGA-9hvf-x884-55q7CGA-9jxf-52wg-f7m2CGA-9phx-9x9m-wpjmCGA-9qqv-p65r-6fcgCGA-c5xm-fj9m-h3hxCGA-ccc8-j8x5-mjpmCGA-cjr7-63cp-753gCGA-cvhv-67wf-534xCGA-cw3c-c2rf-r4grCGA-f356-qghq-jpqhCGA-ff99-6j54-h249CGA-fh77-mgh6-j5q5CGA-fm2h-6mx8-vxqjCGA-frcw-cw27-p7j8CGA-frh5-66xx-jjgwCGA-fvm7-v769-j48cCGA-fxjr-36hr-8hv3CGA-g3j9-r8vf-84m7CGA-g6r6-3r5g-3938CGA-g823-2j6m-cq29CGA-g85v-cmhm-2cpxCGA-gf4w-g247-547pCGA-gj9x-56xw-2qx5CGA-gmhr-xmmg-xhfwCGA-gq28-43v4-8852CGA-h26j-wfm2-gw6fCGA-h6gf-f7ph-xq54CGA-h6j4-gphh-327gCGA-hc9j-p3x8-4gxjCGA-hgjx-mhv8-m4c9CGA-hqrm-hr4x-wm3jCGA-hv47-c58m-gq5wCGA-hx44-3cq6-cx78CGA-j4x3-p768-wq9gCGA-j5g3-xw7w-v368CGA-j5qv-p5p3-ph64CGA-j5rm-q7h2-255gCGA-j72h-qvw5-g4xmCGA-jc63-69mq-fqv3CGA-jcwm-x83c-w88wCGA-jfqc-pqqj-4pqrCGA-jv4r-66x5-h2pfCGA-jwp6-w7g8-gwf3CGA-m2qg-28cj-33hgCGA-m5cf-q482-qh5xCGA-mr4v-ppw2-g93gCGA-mrmm-6wxv-h4gpCGA-mwwh-m292-w36qCGA-p3cg-49v4-4vxcCGA-p3w7-j42c-frr6CGA-p684-6fm5-xvh6CGA-pc7q-g6f7-wwg3CGA-pggh-pw6w-m86fCGA-phrr-hf6q-677jCGA-pq3p-2c2w-j4xqCGA-2wmv-q77q-63xmCGA-374x-m6rf-mx69CGA-39gq-qrmw-fg64CGA-3f52-57f6-59wrCGA-3hmf-96f6-4x57CGA-3wfw-377v-g5p9CGA-4642-x4cq-2wx5CGA-4p2w-wr8c-7w59CGA-5f97-23rx-jv36CGA-5hq6-3ww3-phhmCGA-66mr-q9g4-2r7wCGA-699q-3r2j-4h82CGA-6c9m-w59g-jcf3CGA-7328-8rwq-8mfgCGA-773f-89c7-84hrCGA-789f-xj97-m6jxCGA-7rfm-58p5-jhfvCGA-823p-h4hj-g48wCGA-847p-p8rv-w93hCGA-97jm-qp8x-963wCGA-9fp3-p7gq-3q2xCGA-9j8c-6x96-m45rCGA-9x5j-m65c-3wfhCGA-c2qp-8qv9-64w5CGA-c5fj-gxjj-jvrxCGA-g58j-5989-x7vfCGA-ghvh-pwjm-429jCGA-ghxv-mp58-4v2pCGA-h77p-28p4-mj2rCGA-hw57-gjmp-cm4hCGA-j738-23pv-48pjCGA-jh3q-725j-6vc4CGA-p3jc-p7jx-6m4wCGA-ph6f-g3v3-w9x3CGA-pr2f-c7r4-54hgCGA-q77v-9hmr-mx98CGA-q96q-968w-5mvqCGA-qf9q-hg4v-h5jvCGA-qhq9-jm5j-5vc3CGA-qq94-7q7p-p7m9CGA-qvwh-h9rf-4wxxCGA-r47q-xprr-86wvCGA-r9vm-wf5h-pfh4CGA-rcm9-3c4w-9jp5CGA-rgc3-6h9j-pvgwCGA-rv6w-26ff-h762CGA-rw6q-r98g-v7j7CGA-rwpv-xhg4-p2w5CGA-v5r2-p67q-5qpxCGA-v84v-7q39-3c27CGA-vfj4-m6p9-5pjqCGA-wg7c-7mmh-j8wfCGA-wgfw-2m6v-r294CGA-wh74-p2hj-4g3pCGA-wjrj-9r7v-224qCGA-wrqg-c7vw-9v8fCGA-wrxj-3hh9-hhmgCGA-wv29-h5x3-jjf9CGA-x2jw-hrmp-p27mCGA-xf69-m5qm-hrr3CGA-xv4c-g3w9-3pwqCGA-xv7r-gwh5-h9whCGA-xxr3-9g82-f37gCGA-f7m8-c7jg-vrm2CGA-g6gg-8x6f-8pjq
Advisory lineage Upstream: 0 Downstream: 13
Modified
Published: 06 Dec 2023, 16:27
Last modified:13 Feb 2025, 17:14

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
1.14% LOW
1% probability +1.08%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

06 Dec 2023, 16:27
Published
Vulnerability first disclosed
13 Feb 2025, 17:14
Last Modified
Vulnerability information updated

Description

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 1.14%• Percentile: 65%

Affected Systems

  • chainguard•aactl

    < 0.4.12-r5

  • chainguard•amass

    < 4.2.0-r3

  • chainguard•aws-flb-cloudwatch

    < 1.9.4-r6

  • chainguard•aws-flb-firehose

    < 1.7.2-r6

  • chainguard•aws-flb-kinesis

    < 1.10.2-r6

  • chainguard•bank-vaults-fips

    < 1.20.4-r3

  • chainguard•cass-operator

    < 1.18.2-r3

  • chainguard•cass-operator-fips

    < 1.18.2-r1

  • chainguard•cni-plugins

    < 1.4.0-r1

  • chainguard•cni-plugins-fips

    < 1.4.0-r1

  • chainguard•configmap-reload

    < 0.12.0-r3

  • chainguard•configmap-reload-fips

    < 0.12.0-r2

  • chainguard•configmap-reload-fips-0.11

    < 0.11.1-r3

  • chainguard•cortex

    < 1.16.0-r1

  • chainguard•ctop

    < 0.7.7-r10

  • chainguard•dgraph

    < 23.1.0-r4

  • chainguard•docker-cli

    < 24.0.6-r1

  • chainguard•docker-credential-ecr-login

    < 0.7.1-r8

  • chainguard•flannel-cni-plugin

    < 1.2.0-r5

  • chainguard•fulcio-fips

    < 1.4.3-r1

  • chainguard•gke-gcloud-auth-plugin

    < 0.0.2-r6

  • chainguard•go-bindata

    < 3.1.3-r15

  • chainguard•go-licenses

    < 1.6.0-r8

  • chainguard•go-md2man

    < 2.0.3-r1

  • chainguard•gobuster

    < 3.6.0-r4

  • chainguard•gops

    < 0.3.28-r4

  • chainguard•gosu

    < 1.17-r2

  • chainguard•grpcurl

    < 1.8.9-r2

  • chainguard•helm-push

    < 0.10.4-r1

  • chainguard•hey

    < 0.1.4-r9

  • chainguard•hubble-ui-backend

    < 0.13.3-r1

  • chainguard•influx

    < 2.7.3-r8

  • chainguard•ip-masq-agent

    < 2.9.3-r6

  • chainguard•jsonnet-bundler

    < 0.5.1-r1

  • chainguard•k3d

    < 5.6.0-r5

  • chainguard•katib-earlystopping

    < 0.19.0-r31

  • chainguard•katib-suggestion-goptuna-compat

    all

  • chainguard•katib-suggestion-hyperband

    < 0.19.0-r31

  • chainguard•katib-suggestion-hyperopt

    < 0.19.0-r31 | < 0.19.0-r40

  • chainguard•katib-suggestion-nas-darts

    < 0.19.0-r31

  • chainguard•katib-suggestion-nas-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-optuna-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-pbt-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-skopt-enas

    < 0.19.0-r31

  • chainguard•katib-tfevent-metricscollector

    < 0.19.0-r31

  • chainguard•kind

    < 0.21.0-r0

  • chainguard•kube-logging-logging-operator-4.1

    < 4.1.0-r3

  • chainguard•kubernetes-csi-livenessprobe-2.10

    < 2.10.0-r4

  • chainguard•kubernetes-csi-livenessprobe-fips

    < 2.11.0-r4

  • chainguard•kubernetes-csi-livenessprobe-fips-2.10

    < 2.10.0-r4

Showing first 50 affected entries in server-rendered view.

References (6)