Vulnerability in Golang Go
CVE-2023-45284
On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.
EPSS: 0.009 (56.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Golang Go
- Go Standard Library Path/filepath — versions 0, 1.21.0-0
- Microsoft Windows
Public proof-of-concept exploits
References
- security@golang.org (Issue Tracking, Vendor Advisory)
- security@golang.org (Issue Tracking, Vendor Advisory)
- security@golang.org (Mailing List, Issue Tracking, Vendor Advisory)
- security@golang.org (Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-45284?
- CVE-2023-45284 is a medium-severity vulnerability in Golang Go, classified under CWE-41: IMPROPER RESOLUTION OF PATH EQUIVALENCE. CVSS score: 5.3/10. Published 2023-11-09.
- How severe is CVE-2023-45284?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2023-45284 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.