5.3
Medium
CVE-2023-45284 On Windows, The IsLocal function does not correctly detect reserved device names in some cases
Description
On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| path/filepath 1.21 | 1.21.0-0 → < 1.21.4 | 1.21.4 |
| path/filepath 1.20 | earliest → < 1.20.11 | 1.20.11 |
| Go 1.21 | 1.21.0-0 → < 1.21.4 | 1.21.4 |
| Go 1.20 | earliest → < 1.20.11 | 1.20.11 |
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of path/filepath
The 6 CVEs of path/filepath →
CVE-2024-8244
The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions…
3.7
Low
CVE-2023-45283
The filepath package does not recognize paths with a \??\ prefix as special
Not rated
CVE-2022-41722
A path traversal vulnerability exists in filepath.Clean on Windows
Not rated
CVE-2022-30632
Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic…
Not rated