Command 'go get' may unexpectedly fallback to insecure git in cmd/go

CVE-2023-45285

What is CVE-2023-45285?

This vulnerability occurs when using 'go get' to fetch a module with a '.git' suffix, potentially causing a fallback to the insecure 'git://' protocol if the requested module is unavailable via secure 'https://' and 'git+ssh://' protocols. This can pose a risk for users operating with module proxy disabled (GOPROXY=off), as their configurations inadvertently expose them to insecure connections despite the GOINSECURE setting remaining inactive for specific modules. It's essential for developers to be aware of this behaviour in order to safeguard their projects.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References