| id: GO-2022-0318 |
| modules: |
| - module: cmd |
| versions: |
| - fixed: 1.16.14 |
| - introduced: 1.17.0-0 |
| - fixed: 1.17.7 |
| vulnerable_at: 1.17.6 |
| packages: |
| - package: cmd/go/internal/modfetch |
| symbols: |
| - codeRepo.convert |
| - codeRepo.validatePseudoVersion |
| skip_fix: 'TODO: revisit this reason (cant request explicit version v1.17.6 of standard library package cmd/go/internal/modfetch)' |
| summary: Incorrect access control in the go command in cmd/go/internal/modfetch |
| description: |- |
| Incorrect access control is possible in the go command. |
| |
| The go command can misinterpret branch names that falsely appear to be version |
| tags. This can lead to incorrect access control if an actor is authorized to |
| create branches but not tags. |
| published: 2022-08-01T22:20:42Z |
| cves: |
| - CVE-2022-23773 |
| references: |
| - fix: https://go.dev/cl/378400 |
| - fix: https://go.googlesource.com/go/+/fa4d9b8e2bc2612960c80474fca83a4c85a974eb |
| - report: https://go.dev/issue/35671 |
| - web: https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ |
| review_status: REVIEWED |
