| id: GO-2025-3383 |
| modules: |
| - module: cmd |
| versions: |
| - introduced: 1.24.0-0 |
| - fixed: 1.24.0-rc.2 |
| vulnerable_at: 1.24.0-rc.1 |
| packages: |
| - package: cmd/go |
| summary: GOAUTH credential leak in cmd/go |
| description: |- |
| Credentials provided via the new GOAUTH feature were not being properly |
| segmented by domain, allowing a malicious server to request credentials they |
| should not have access to. By default, unless otherwise set, this only affected |
| credentials stored in the users .netrc file. |
| credits: |
| - Juho Forsén of Mattermost |
| references: |
| - fix: https://go.dev/cl/643097 |
| - report: https://go.dev/issue/71249 |
| - web: https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ |
| cve_metadata: |
| id: CVE-2024-45340 |
| cwe: 'CWE-201: Insertion of Sensitive Information Into Sent Data' |
| source: |
| id: go-security-team |
| created: 2025-01-27T15:30:57.076461-05:00 |
| review_status: REVIEWED |
