| Copyright 2024 The Go Authors. All rights reserved. |
| Use of this source code is governed by a BSD-style |
| license that can be found in the LICENSE file. |
| |
| Expected output of TestCVEToReport/CVE-2023-45285. |
| |
| -- CVE-2023-45285 -- |
| id: PLACEHOLDER-ID |
| modules: |
| - module: std |
| packages: |
| - package: cmd/go |
| description: | |
| Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off). |
| references: |
| - web: https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ |
| - report: https://go.dev/issue/63845 |
| - fix: https://go.dev/cl/540257 |
| - web: https://pkg.go.dev/vuln/GO-2023-2383 |
| cve_metadata: |
| id: CVE-2023-45285 |
| cwe: 'CWE-636: Not Failing Securely (''Failing Open'')' |
| source: |
| id: CVE-2023-45285 |
