Command 'go get' may unexpectedly fallback to insecure git in cmd/go

CVE-2023-45285

What is CVE-2023-45285?

This vulnerability occurs when using 'go get' to fetch a module with a '.git' suffix, potentially causing a fallback to the insecure 'git://' protocol if the requested module is unavailable via secure 'https://' and 'git+ssh://' protocols. This can pose a risk for users operating with module proxy disabled (GOPROXY=off), as their configurations inadvertently expose them to insecure connections despite the GOINSECURE setting remaining inactive for specific modules. It's essential for developers to be aware of this behaviour in order to safeguard their projects.

References