CVE-2023-45284

NameCVE-2023-45284
DescriptionOn Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
golang-1.11 (PTS)buster (security), buster, buster (lts)1.11.6-1+deb10u7vulnerable
golang-1.15 (PTS)bullseye1.15.15-1~deb11u4vulnerable
golang-1.19 (PTS)bookworm1.19.8-2vulnerable
golang-1.7 (PTS)stretch (security), stretch (lts), stretch1.7.4-2+deb9u5vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
golang-1.11source(unstable)(unfixed)unimportant
golang-1.15source(unstable)(unfixed)unimportant
golang-1.19source(unstable)(unfixed)unimportant
golang-1.20source(unstable)1.20.11-1unimportant
golang-1.21unknown(unstable)1.21.4-1unimportant
golang-1.7source(unstable)(unfixed)unimportant

Notes

https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY
https://github.com/golang/go/issues/63713
https://github.com/golang/go/commit/9e933c189ca3a84f12995b3c799364a06abc4376 (go1.21.4)
https://github.com/golang/go/commit/46fb78168596f7ce8834f528bb0eb9555c08bcae (go1.20.11)
No security impact for Debian packages, only affects code running on Windows

Search for package or bug name: Reporting problems