Read the docs
TI-2023-24275 Aliases CVE-2023-45285GHSA-5f94-vhjq-rpg8

Command 'go get' may unexpectedly fallback to insecure git in cmd/go

Priority LOW 35Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 5 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).

Why it matters now

EPSS 0.01137 66th percentileScored 2026-11-07
Fix Partial cmd/go (Go toolchain): 1.20.12, 1.21.5Red Hat: 4 advisoriesRed Hat: 5 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarycmd/gobefore 1.20.12; 1.21.0-0 to before 1.21.51.20.12, 1.21.5Patch availableCNA
  • cmd/go VendorGo standard library Affected before 1.20.12; 1.21.0-0 to before 1.21.5 Fixed in 1.20.12, 1.21.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.20.12; 1.21.0-0 to before 1.21.5VulnerableGo standard library
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.20.12; 1.21.0-0 to before 1.21.5 Vulnerable ·Go standard library

Remediation

  • Fix · CNA cmd/go (Go toolchain) Fixed in 1.20.12, 1.21.5

Red Hat 4 advisories

  • RHSA-2024:1131 Released 2024-03-05 · Red Hat rating Moderate
    golang security update
    • Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.20.12-1.el9_3, golang-1.20.12-1.el9_3, golang-bin-1.20.12-1.el9_3 +4
  • RHSA-2024:1041 Released 2024-02-29 · Red Hat rating Moderate
    go-toolset-1.19-golang security update
    • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.19-golang-1.19.13-5.el7_9, go-toolset-1.19-golang-bin-1.19.13-5.el7_9, go-toolset-1.19-golang-docs-1.19.13-5.el7_9 +4
    • Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.19-golang-1.19.13-5.el7_9, go-toolset-1.19-golang-bin-1.19.13-5.el7_9, go-toolset-1.19-golang-docs-1.19.13-5.el7_9 +4
  • RHSA-2023:7198 Released 2024-02-27 · Red Hat rating Critical
    OpenShift Container Platform 4.15.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
Show 1 more Red Hat advisories
  • RHSA-2024:0887 Released 2024-02-20 · Red Hat rating Moderate
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.20.2-1.module+el8.9.0+18926+5193682d.src::go-toolset:rhel8, delve-1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8, go-toolset-1.20.12-1.module+el8.9.0+21033+5795bdf6.aarch64::go-toolset:rhel8 +17

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2024:1041
Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2024:1041
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:0887
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:1131
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2023:7198
Not affected: 3 products
  • OpenShift Service Mesh 2
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.15

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-45285
  2. 2026-10-03 Alias added: GHSA-5f94-vhjq-rpg8

References

Patch 2

Advisory 2

Other 1

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences