| Copyright 2024 The Go Authors. All rights reserved. |
| Use of this source code is governed by a BSD-style |
| license that can be found in the LICENSE file. |
| |
| Expected output of TestCVE5ToReport/CVE-2023-45285. |
| |
| -- CVE-2023-45285 -- |
| id: PLACEHOLDER-ID |
| modules: |
| - module: cmd |
| versions: |
| - fixed: 1.20.12 |
| - introduced: 1.21.0-0 |
| fixed: 1.21.5 |
| packages: |
| - package: cmd/go |
| summary: Command 'go get' may unexpectedly fallback to insecure git in cmd/go |
| description: |- |
| Using go get to fetch a module with the ".git" suffix may unexpectedly fallback |
| to the insecure "git://" protocol if the module is unavailable via the secure |
| "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said |
| module. This only affects users who are not using the module proxy and are |
| fetching modules directly (i.e. GOPROXY=off). |
| credits: |
| - David Leadbeater |
| references: |
| - web: https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ |
| - report: https://go.dev/issue/63845 |
| - fix: https://go.dev/cl/540257 |
| - web: https://pkg.go.dev/vuln/GO-2023-2383 |
| cve_metadata: |
| id: CVE-2023-45285 |
| cwe: 'CWE-636: Not Failing Securely (''Failing Open'')' |
| source: |
| id: CVE-2023-45285 |
