internal/cve4/testdata/cve/TestToReport/CVE-2023-45285.txtar

Copyright 2025 The Go Authors. All rights reserved.
Use of this source code is governed by a BSD-style
license that can be found in the LICENSE file.

Expected output of TestToReport/CVE-2023-45285.

-- CVE-2023-45285_UNREVIEWED --
id: GO-ID-PENDING
modules:
    - module: std
      packages:
        - package: cmd/go
summary: CVE-2023-45285 in cmd/go
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-45285
    - fix: https://go.dev/cl/540257
    - report: https://go.dev/issue/63845
    - web: https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
cve_metadata:
    id: CVE-2023-45285
    cwe: 'CWE-636: Not Failing Securely (''Failing Open'')'
notes:
    - fix: 'std: could not add vulnerable_at: not implemented for std/cmd'
    - lint: 'description: missing (reports with Go CVEs must have a description)'
    - lint: 'modules[0] "std": packages[0] "cmd/go": at least one of vulnerable_at and skip_fix must be set'
    - lint: 'modules[0] "std": packages[0] "cmd/go": must be in module cmd'
    - lint: 'references[0] "https://nvd.nist.gov/vuln/detail/CVE-2023-45285": "https://nvd.nist.gov/vuln/detail/CVE-2023-45285": advisory reference must not be set for first-party issues'
source:
    id: CVE-2023-45285
    created: 1999-01-01T00:00:00Z
review_status: UNREVIEWED
-- CVE-2023-45285_REVIEWED --
id: GO-ID-PENDING
modules:
    - module: std
      packages:
        - package: cmd/go
summary: CVE-2023-45285 in cmd/go
description: |-
    Using go get to fetch a module with the ".git" suffix may unexpectedly fallback
    to the insecure "git://" protocol if the module is unavailable via the secure
    "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said
    module. This only affects users who are not using the module proxy and are
    fetching modules directly (i.e. GOPROXY=off).
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-45285
    - fix: https://go.dev/cl/540257
    - report: https://go.dev/issue/63845
    - web: https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
cve_metadata:
    id: CVE-2023-45285
    cwe: 'CWE-636: Not Failing Securely (''Failing Open'')'
notes:
    - fix: 'std: could not add vulnerable_at: not implemented for std/cmd'
    - lint: 'modules[0] "std": packages[0] "cmd/go": at least one of vulnerable_at and skip_fix must be set'
    - lint: 'modules[0] "std": packages[0] "cmd/go": must be in module cmd'
    - lint: 'references[0] "https://nvd.nist.gov/vuln/detail/CVE-2023-45285": "https://nvd.nist.gov/vuln/detail/CVE-2023-45285": advisory reference must not be set for first-party issues'
source:
    id: CVE-2023-45285
    created: 1999-01-01T00:00:00Z
review_status: REVIEWED