Command 'go get' may unexpectedly fallback to insecure git in cmd/go

published 2023-12-06 2 y ago modified 2026-09-08 2 mo ago also BIT-golang-2023-45285 , EUVD-2023-49586 , GO-2023-2383

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits: 0; none known

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).

Patch / fix

fixed in 3 distros 6 links 2

bitnami golang 1.20.12, 1.21.5
go toolchain 1.20.12, 1.21.5
Go toolchain cmd/go 1.20.12, 1.21.5

ubuntu red hat suse opensuse almalinux azure linux

golang-1.20 Ubuntu 20.04 LTS 1.20.3-1ubuntu0.1~20.04.1
golang-1.20 Ubuntu 22.04 LTS 1.20.3-1ubuntu0.1~22.04.1
golang-1.21 Ubuntu 20.04 LTS 1.21.1-1~ubuntu20.04.2
golang-1.21 Ubuntu 22.04 LTS 1.21.1-1~ubuntu22.04.2

ubuntu advisories UBUNTU-CVE-2023-45285

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

delve RHEL 8 1.20.2-1.module+el8.9.0+18926+5193682d
golang RHEL 8 1.20.12-2.module+el8.9.0+21033+5795bdf6
go-toolset RHEL 8 1.20.12-1.module+el8.9.0+21033+5795bdf6
golang-bin RHEL 8 1.20.12-2.module+el8.9.0+21033+5795bdf6
golang-src RHEL 8 1.20.12-2.module+el8.9.0+21033+5795bdf6
golang-misc RHEL 8 1.20.12-2.module+el8.9.0+21033+5795bdf6
golang-tests RHEL 8 1.20.12-2.module+el8.9.0+21033+5795bdf6
golang RHEL 9 1.20.12-1.el9_3

red hat advisories RHSA-2024:0887 RHSA-2024:1131 RHSA-2024:1041

go1.21-openssl SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.21.5.1-150000.1.8.1
go1.20-openssl SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.20.12.1-150000.1.17.1
go1.21 SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.21.5-150000.1.18.1
go1.20 SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.20.12-150000.1.35.1

suse advisories SUSE-SU-2023:4931-1 SUSE-SU-2023:4930-1 SUSE-SU-2023:4709-1 SUSE-SU-2023:4708-1

go1.20 openSUSE Tumbleweed 1.20.12-1.1
go1.21 openSUSE Tumbleweed 1.21.5-1.1

opensuse advisories openSUSE-SU-2024:13491-1 openSUSE-SU-2024:13492-1

golang AlmaLinux 9 1.20.12-1.el9_3
go-toolset AlmaLinux 9 1.20.12-1.el9_3
golang-bin AlmaLinux 9 1.20.12-1.el9_3
golang-src AlmaLinux 9 1.20.12-1.el9_3
golang-misc AlmaLinux 9 1.20.12-1.el9_3
golang-tests AlmaLinux 9 1.20.12-1.el9_3
delve AlmaLinux 8 1.20.2-1.module_el8.9.0+3642+43318da8
golang AlmaLinux 8 1.20.12-2.module_el8.9.0+3728+f1d47c6f

almalinux advisories ALSA-2024:1131 ALSA-2024:0887

golang CBL-Mariner 2.0 1.21.6-1
msft-golang CBL-Mariner 2.0 1.22.3-1.

azure linux advisories AZL-32101 AZL-32103 AZL-37323 AZL-37438

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

go.dev/cl/540257 patch
pkg.go.dev/vuln/GO-2023-2383 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-45285 updated 2026-09-08 cvss 7.5

golang: cmd/go: Protocol Fallback when fetching modules

Red Hat OpenShift Virtualization 4 openshift-golang-builder-container
affected: workaround, no fix available
Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests
affected: workaround, no fix planned “Will not fix”
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.19-golang 1.19.13-5.el7_9, go-toolset-1.19-golang-bin 1.19.13-5.el7_9, go-toolset-1.19-golang-src 1.19.13-5.el7_9, go-toolset-1.19-golang-misc 1.19.13-5.el7_9, go-toolset-1.19-golang-race 1.19.13-5.el7_9, go-toolset-1.19-golang-tests 1.19.13-5.el7_9 Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.19-golang 1.19.13-5.el7_9, go-toolset-1.19-golang-bin 1.19.13-5.el7_9, go-toolset-1.19-golang-src 1.19.13-5.el7_9, go-toolset-1.19-golang-misc 1.19.13-5.el7_9, go-toolset-1.19-golang-race 1.19.13-5.el7_9, go-toolset-1.19-golang-tests 1.19.13-5.el7_9
fixed: vendor fix RHSA-2024:1041
Red Hat Enterprise Linux AppStream (v. 8) delve 1.20.2-1.module+el8.9.0+18926+5193682d, golang 1.20.12-2.module+el8.9.0+21033+5795bdf6, go-toolset 1.20.12-1.module+el8.9.0+21033+5795bdf6, golang-bin 1.20.12-2.module+el8.9.0+21033+5795bdf6, golang-src 1.20.12-2.module+el8.9.0+21033+5795bdf6, golang-misc 1.20.12-2.module+el8.9.0+21033+5795bdf6, +1 more
fixed: vendor fix RHSA-2024:0887
Red Hat Enterprise Linux AppStream (v. 9) golang 1.20.12-1.el9_3, go-toolset 1.20.12-1.el9_3, golang-bin 1.20.12-1.el9_3, golang-src 1.20.12-1.el9_3, golang-misc 1.20.12-1.el9_3, golang-tests 1.20.12-1.el9_3
fixed: vendor fix RHSA-2024:1131
Red Hat OpenShift Container Platform 4.15 openshift4/ose-cli v4.15.0-202402082307.p0.g48dcf59.assembly.stream.el8, openshift4/ose-tests v4.15.0-202402210808.p0.gb71aeaf.assembly.stream.el8, openshift4/ose-etcd-rhel9 v4.15.0-202401261531.p0.g5acb4f3.assembly.stream, openshift4/ose-prometheus v4.15.0-202401290854.p0.g6828e44.assembly.stream, openshift4/ose-console v4.15.0-202402151637.p0.g803df88.assembly.stream.el8, openshift4/ose-coredns-rhel9 v4.15.0-202401261531.p0.g22f950e.assembly.stream, +177 more
fixed: vendor fix RHSA-2023:7198
Red Hat OpenShift Service Mesh 2 openshift-golang-builder-container Red Hat OpenShift Container Platform 4 openshift-golang-builder-container Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202402201450-0, openshift4/ose-deployer v4.15.0-202402082307.p0.g48dcf59.assembly.stream.el8, openshift4/ose-tools-rhel8 v4.15.0-202402210808.p0.g48dcf59.assembly.stream.el8, openshift4/ose-ironic-rhel9 v4.15.0-202402151537.p0.ge38f8df.assembly.stream.el9, openshift4/ose-haproxy-router v4.15.0-202402082307.p0.gb700113.assembly.stream.el8, openshift4/driver-toolkit-rhel9 v4.15.0-202402201538.p0.g7a448c2.assembly.stream.el9, +6 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.14% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
bitnami	golang	<1.20.12 >=1.21.0-0, <1.21.5	1.20.12 1.21.5
go	toolchain	<1.20.12 >=1.21.0-0, <1.21.5	1.20.12 1.21.5

Affected products

Go toolchain cmd/go

References

go.dev /cl/540257
patch
pkg.go.dev /vuln/GO-2023-2383
patch, vendor-advisory, advisory
groups.google.com /g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
mailing-list, vendor-advisory, advisory, web
go.dev /issue/63845
issue-tracking, vendor-advisory, advisory, report
lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G/
web
nvd.nist.gov /vuln/detail/CVE-2023-45285
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary