Skip to content
fr Sign in
Not rated

CVE-2023-45285 Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the…

Description

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).

Affected products and versions

Product Affected versions Fixed in
cmd/go 1.21 1.21.0-0 → < 1.21.5 1.21.5
cmd/go 1.20 earliest → < 1.20.12 1.20.12

References

Timeline

  1. Published
  2. Last modified

Other CVEs of cmd/go

The 23 CVEs of cmd/go →
CVE-2026-94444 Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a… 7.8 High CVE-2026-94447 Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and… 7.8 High CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to… 8.4 High CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log 7.5 High
Track this CVE