CVE-2022-23773

Name	CVE-2022-23773
Description	cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-1.11 (PTS)	buster, buster (security)	1.11.6-1+deb10u4	vulnerable
golang-1.15 (PTS)	bullseye	1.15.15-1~deb11u4	fixed
golang-1.17 (PTS)	bookworm, sid	1.17.9-1	fixed
golang-1.18 (PTS)	bookworm	1.18.1-1	fixed
	sid	1.18.2-2	fixed
golang-1.7 (PTS)	stretch	1.7.4-2+deb9u1	fixed
	stretch (security)	1.7.4-2+deb9u5	fixed
golang-1.8 (PTS)	stretch	1.8.1-1+deb9u1	fixed
	stretch (security)	1.8.1-1+deb9u5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
golang-1.11	source	(unstable)	(unfixed)
golang-1.15	source	bullseye	1.15.15-1~deb11u3
golang-1.15	source	(unstable)	(unfixed)
golang-1.17	source	(unstable)	1.17.7-1
golang-1.18	source	(unstable)	1.18~rc1-1
golang-1.7	source	stretch	(not affected)
golang-1.7	source	(unstable)	(unfixed)
golang-1.8	source	stretch	(not affected)
golang-1.8	source	(unstable)	(unfixed)

Notes

[buster] - golang-1.11 <no-dsa> (Minor issue)
[stretch] - golang-1.8 <not-affected> (vgo/modfetch module not present)
[stretch] - golang-1.7 <not-affected> (vgo/modfetch module not present)
https://github.com/golang/go/issues/35671
https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
https://github.com/golang/go/commit/fbcc30a2c9d076b27b4b411e2cec91ec13528081 (go1.17.7)