阿里云漏洞库

漏洞描述

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://go.dev/cl/540257
https://go.dev/issue/63845
https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorapr...
https://pkg.go.dev/vuln/GO-2023-2383

受影响软件情况

1
#	类型	厂商	产品	版本	影响面
	运行在以下环境
	应用	golang	go	*		Up to (excluding) 1.20.12
	运行在以下环境
	应用	golang	go	*	From (including) 1.21.0-0	Up to (excluding) 1.21.5
	运行在以下环境
	系统	fedora_39	golang	*		Up to (excluding) 1.21.6-1.fc39
	运行在以下环境
	系统	kylinos_aarch64_V10	golang	*		Up to (excluding) 1.15.7-37.p02.ky10
	运行在以下环境
	系统	kylinos_aarch64_V10SP1	golang	*		Up to (excluding) 1.15.7-37.p02.ky10
	运行在以下环境
	系统	kylinos_aarch64_V10SP2	golang	*		Up to (excluding) 1.15.7-37.p02.ky10
	运行在以下环境
	系统	kylinos_aarch64_V10SP3	golang	*		Up to (excluding) 1.15.7-37.p02.ky10
	运行在以下环境
	系统	kylinos_aarch64_V10SP32309b	golang	*		Up to (excluding) 1.15.7-37.p02.ky10
	运行在以下环境
	系统	kylinos_loongarch64_V10SP1	golang	*		Up to (excluding) 1.15.7-37.p03.a.ky10
	运行在以下环境
	系统	kylinos_loongarch64_V10SP3	golang	*		Up to (excluding) 1.15.7-37.p03.a.ky10
	运行在以下环境
	系统	kylinos_x86_64_V10	golang	*		Up to (excluding) 1.15.7-37.p02.ky10
	运行在以下环境
	系统	kylinos_x86_64_V10SP1	golang	*		Up to (excluding) 1.15.7-37.p02.ky10
	运行在以下环境
	系统	kylinos_x86_64_V10SP2	golang	*		Up to (excluding) 1.15.7-37.p02.ky10
	运行在以下环境
	系统	kylinos_x86_64_V10SP3	golang	*		Up to (excluding) 1.15.7-37.p02.ky10
	运行在以下环境
	系统	opensuse_Leap_15.4	go1.21	*		Up to (excluding) 1.21.5-150000.1.18.1
	运行在以下环境
	系统	opensuse_Leap_15.5	go1.20	*		Up to (excluding) 1.20.12-150000.1.35.1
	运行在以下环境
	系统	ubuntu_20.04	golang-1.20	*		Up to (excluding) 1.20.3-1ubuntu0.1~20.04.1
	运行在以下环境
	系统	ubuntu_22.04	golang-1.20	*		Up to (excluding) 1.21.1-1~ubuntu22.04.2

攻击路径

本地
攻击复杂度

复杂
权限要求

普通权限
影响范围

越权影响
EXP成熟度

未验证
补丁情况

官方补丁
数据保密性

无影响
数据完整性

无影响
服务器危害

无影响
全网数量

N/A

CWE-ID	漏洞类型
NVD-CWE-noinfo

中危 命令“go get”可能会意外回退到 cmd/go 中不安全的 git (CVE-2023-45285)

漏洞描述

解决建议

参考链接

受影响软件情况

中危命令“go get”可能会意外回退到 cmd/go 中不安全的 git (CVE-2023-45285)