CVE-2023-45285 - CVE House

Back to Database

Status published Unknown CVE-2023-45285

Command 'go get' may unexpectedly fallback to insecure git in cmd/go

0 CVSS

Vulnerability Description

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-45285

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

David Leadbeater

References

More from Go toolchain

View All →

Unexpected code execution when invoking toolchain in cmd/go

Potential code smuggling via doc comments in cmd/cgo

Arbitrary file write using cgo pkg-config directive in cmd/go

Unexpected command execution in untrusted VCS repositories in cmd/go

Arbitrary code execution during build on darwin in cmd/go

Affected Vendor

Go toolchain

View all reports →

Affected Software

cmd/go

Vulnerable Versions:

0, 1.21.0-0

Timeline

Official Publish: December 6th, 2023

Last Modified: February 13th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.