Read the docs
TI-2022-07809 Aliases CVE-2022-23773GHSA-52j8-p7r3-733m

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that…

Priority LOW 38CWE-436Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 9 fixed, 16 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

Why it matters now

EPSS 0.02676 85th percentileScored 2026-11-07
Fix Partial Red Hat: 12 advisoriesRed Hat: 9 fixed, 16 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.16.14; 1.17.0 to before 1.17.7VulnerableGo standard library
cpe:2.3:a:netapp:beegfs_csi_driver:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:kubernetes_monitoring_operator:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.16.14; 1.17.0 to before 1.17.7 Vulnerable ·Go standard library
  • cpe:2.3:a:netapp:beegfs_csi_driver:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:kubernetes_monitoring_operator:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

Red Hat 12 advisories

  • RHSA-2023:1529 Released 2023-03-30 · Red Hat rating Moderate
    Service Telemetry Framework 1.5 security update
    • Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8
  • RHSA-2023:0408 Released 2023-01-25 · Red Hat rating Important
    OpenShift Virtualization 4.12.0 Images security update
    • CNV 4.12 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-provisioner-rhel8, container-native-virtualization/hostpath-provisioner-rhel8-operator +9
  • RHSA-2022:6526 Released 2022-09-14 · Red Hat rating Important
    OpenShift Virtualization 4.11.0 Images security and bug fix update
    • CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
Show 9 more Red Hat advisories
  • RHSA-2022:6156 Released 2022-08-24 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update
    • RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-rhel8-operator +12
  • RHSA-2022:6094 Released 2022-08-23 · Red Hat rating Moderate
    OpenShift Container Platform 4.10.28 packages and security update
    • Red Hat OpenShift Container Platform 4.10 cri-o-1.23.3-13.rhaos4.10.git6af791c.1.el7, cri-o-1.23.3-14.rhaos4.10.git6af791c.1.el8
  • RHSA-2022:5068 Released 2022-08-10 · Red Hat rating Moderate
    OpenShift Container Platform 4.11.0 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.11 libsodium-1.0.16-5.el8, libsodium-devel-1.0.16-5.el8, libsodium-static-1.0.16-5.el8 +47
    • Red Hat OpenShift Container Platform 4.11 afterburn-5.3.0-1.rhaos4.11.el8, atomic-openshift-service-idler-4.11.0-202206222028.p0.g39cfc66.assembly.stream.el8, bootupd-0.2.5-3.rhaos4.11.el8 +47
  • RHSA-2022:5875 Released 2022-08-09 · Red Hat rating Moderate
    OpenShift Container Platform 4.10.26 security update
    • Red Hat OpenShift Container Platform 4.10 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
  • RHSA-2022:5729 Released 2022-08-01 · Red Hat rating Moderate
    OpenShift Container Platform 4.10.25 security update
    • Red Hat OpenShift Container Platform 4.10 atomic-openshift-service-idler-4.10.0-202207192015.p0.g39cfc66.assembly.stream.el8, cri-o-1.23.3-11.rhaos4.10.gitddf4b1a.1.el7, cri-o-1.23.3-11.rhaos4.10.gitddf4b1a.1.el8 +10
  • RHSA-2022:5004 Released 2022-06-13 · Red Hat rating Critical
    Red Hat OpenShift Service Mesh 2.1.3 security update
    • OpenShift Service Mesh 2.1 servicemesh-2.1.3-1.el8, servicemesh-cni-2.1.3-1.el8, servicemesh-operator-2.1.3-2.el8 +6
  • RHSA-2022:4863 Released 2022-06-01 · Red Hat rating Moderate
    Release of OpenShift Serverless Version 1.22.1
    • Red Hat OpenShift Serverless 1.22 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +35
  • RHSA-2022:4860 Released 2022-06-01 · Red Hat rating Moderate
    Release of OpenShift Serverless Client kn 1.22.1
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.1.0-3.el8
  • RHSA-2022:1819 Released 2022-05-10 · Red Hat rating Moderate
    go-toolset:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.7-1.module+el8.6.0+14297+32a15e19.aarch64::go-toolset:rhel8 +18

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for ContainersAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
OpenShift Service Mesh 2.0AffectedNo fix yet
OpenShift Service Mesh 2.1AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Virtualization 2AffectedNo fix planned: Out of support scope
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift distributed tracing 2AffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 16.1AffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Service Telemetry Framework 1.3 for RHEL 8AffectedNo fix planned: Will not fix
Service Telemetry Framework 1.4 for RHEL 8AffectedNo fix planned: Will not fix
CNV 4.12 for RHEL 8Fixed RHSA-2023:0408
OpenShift Service Mesh 2.1Fixed RHSA-2022:5004
RHODF 4.11 for RHEL 8Fixed RHSA-2022:6156
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:1819
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2022:5729, RHSA-2022:5875, RHSA-2022:6094
Red Hat OpenShift Container Platform 4.11Fixed RHSA-2022:5068
Red Hat OpenShift Serverless 1.0Fixed RHSA-2022:4860
Red Hat OpenShift Serverless 1.22Fixed RHSA-2022:4863
Service Telemetry Framework 1.5 for RHEL 8Fixed RHSA-2023:1529
Not affected: 13 products
  • CNV 4.12 for RHEL 8
  • Ironic content for Red Hat OpenShift Container Platform 4.11
  • RHODF 4.11 for RHEL 8
  • Red Hat Ceph Storage 4
  • Red Hat Ceph Storage 5
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Container Platform 4.11
  • Red Hat OpenShift on AWS
  • Red Hat Openshift Data Foundation 4
  • Red Hat Quay 3
  • Red Hat Storage 3
  • Service Telemetry Framework 1.5 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23773
  2. 2026-10-03 Alias added: GHSA-52j8-p7r3-733m

References

Advisory 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences