id: GO-2023-2383
modules:
    - module: cmd
      versions:
        - fixed: 1.20.12
        - introduced: 1.21.0-0
          fixed: 1.21.5
      vulnerable_at: 1.21.4
      packages:
        - package: cmd/go
summary: Command 'go get' may unexpectedly fallback to insecure git in cmd/go
description: |-
    Using go get to fetch a module with the ".git" suffix may unexpectedly fallback
    to the insecure "git://" protocol if the module is unavailable via the secure
    "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said
    module. This only affects users who are not using the module proxy and are
    fetching modules directly (i.e. GOPROXY=off).
credits:
    - David Leadbeater
references:
    - web: https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
    - report: https://go.dev/issue/63845
    - fix: https://go.dev/cl/540257
cve_metadata:
    id: CVE-2023-45285
    cwe: 'CWE-636: Not Failing Securely (''Failing Open'')'
    references:
        - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G/