CVE-2022-23773

NameCVE-2022-23773
Descriptioncmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
golang (PTS)jessie, jessie (lts)2:1.3.3-1+deb8u5fixed
golang-1.11 (PTS)buster (security), buster, buster (lts)1.11.6-1+deb10u7vulnerable
golang-1.15 (PTS)bullseye1.15.15-1~deb11u4fixed
golang-1.7 (PTS)stretch (security), stretch (lts), stretch1.7.4-2+deb9u5fixed
golang-1.8 (PTS)stretch (security), stretch (lts), stretch1.8.1-1+deb9u5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
golangsourcejessie(not affected)
golangsource(unstable)(unfixed)
golang-1.11source(unstable)(unfixed)
golang-1.15sourcebullseye1.15.15-1~deb11u3
golang-1.15source(unstable)(unfixed)
golang-1.17unknown(unstable)1.17.7-1
golang-1.18source(unstable)1.18~rc1-1
golang-1.7sourcestretch(not affected)
golang-1.7source(unstable)(unfixed)
golang-1.8sourcestretch(not affected)
golang-1.8source(unstable)(unfixed)

Notes

[buster] - golang-1.11 <ignored> (Limited support, minor issue, requires branching access in hostile repository, intrusive patch, different code)
[stretch] - golang-1.8 <not-affected> (vgo/modfetch module not present)
[stretch] - golang-1.7 <not-affected> (vgo/modfetch module not present)
https://github.com/golang/go/issues/35671
https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
https://github.com/golang/go/commit/fbcc30a2c9d076b27b4b411e2cec91ec13528081 (go1.17.7)
[jessie] - golang <not-affected> (vgo/modfetch module not present)

Search for package or bug name: Reporting problems