CVE-2022-23773

Name	CVE-2022-23773
Description	cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-1.11 (PTS)	buster, buster (security)	1.11.6-1+deb10u4	vulnerable
golang-1.15 (PTS)	bullseye	1.15.15-1~deb11u4	fixed
golang-1.17 (PTS)	bookworm, sid	1.17.13-3	fixed
golang-1.18 (PTS)	bookworm, sid	1.18.6-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
golang-1.11	source	(unstable)	(unfixed)
golang-1.15	source	bullseye	1.15.15-1~deb11u3
golang-1.15	source	(unstable)	(unfixed)
golang-1.17	source	(unstable)	1.17.7-1
golang-1.18	source	(unstable)	1.18~rc1-1
golang-1.7	source	stretch	(not affected)
golang-1.7	source	(unstable)	(unfixed)
golang-1.8	source	stretch	(not affected)
golang-1.8	source	(unstable)	(unfixed)

Notes

[buster] - golang-1.11 <postponed> (Limited support, minor issue, follow bullseye DSAs/point-releases)
[stretch] - golang-1.8 <not-affected> (vgo/modfetch module not present)
[stretch] - golang-1.7 <not-affected> (vgo/modfetch module not present)
https://github.com/golang/go/issues/35671
https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
https://github.com/golang/go/commit/fbcc30a2c9d076b27b4b411e2cec91ec13528081 (go1.17.7)