CVE-2022-23773

NameCVE-2022-23773
Descriptioncmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
golang-1.11 (PTS)buster, buster (security)1.11.6-1+deb10u4vulnerable
golang-1.15 (PTS)bullseye1.15.15-1~deb11u4fixed
golang-1.17 (PTS)bookworm, sid1.17.9-1fixed
golang-1.18 (PTS)bookworm1.18.1-1fixed
sid1.18.2-2fixed
golang-1.7 (PTS)stretch1.7.4-2+deb9u1fixed
stretch (security)1.7.4-2+deb9u5fixed
golang-1.8 (PTS)stretch1.8.1-1+deb9u1fixed
stretch (security)1.8.1-1+deb9u5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
golang-1.11source(unstable)(unfixed)
golang-1.15sourcebullseye1.15.15-1~deb11u3
golang-1.15source(unstable)(unfixed)
golang-1.17source(unstable)1.17.7-1
golang-1.18source(unstable)1.18~rc1-1
golang-1.7sourcestretch(not affected)
golang-1.7source(unstable)(unfixed)
golang-1.8sourcestretch(not affected)
golang-1.8source(unstable)(unfixed)

Notes

[buster] - golang-1.11 <no-dsa> (Minor issue)
[stretch] - golang-1.8 <not-affected> (vgo/modfetch module not present)
[stretch] - golang-1.7 <not-affected> (vgo/modfetch module not present)
https://github.com/golang/go/issues/35671
https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
https://github.com/golang/go/commit/fbcc30a2c9d076b27b4b411e2cec91ec13528081 (go1.17.7)

Search for package or bug name: Reporting problems