Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golangUpgrade golang-docsUpgrade golang-binUpgrade golang-testsUpgrade delveUpgrade golang-srcUpgrade golang-miscUpgrade go-toolset | Feb 23, 2024 | Dec 6, 2023 |
| Debian | — | No solution exists | May 15, 2025 | Dec 6, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 8, 2024 | Dec 6, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Mar 13, 2024 | Dec 6, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Mar 13, 2024 | Dec 6, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Mar 18, 2025 | Dec 6, 2023 |
| Oracle_linux | — | Upgrade golang-miscUpgrade golang-docsUpgrade go-toolsetUpgrade golangUpgrade golang-binUpgrade golang-testsUpgrade golang-srcUpgrade delve | Feb 23, 2024 | Dec 6, 2023 |
| Redhat_linux | — | Upgrade golang-docsUpgrade go-toolsetUpgrade delve-debuginfoUpgrade delveUpgrade golang-testsUpgrade golangUpgrade delve-debugsourceUpgrade golang-srcUpgrade golang-binUpgrade golang-misc | Feb 21, 2024 | Dec 6, 2023 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.1Upgrade Splunk Enterprise to version 9.2.3Upgrade Splunk Enterprise to version 9.1.6 | Jul 30, 2026 | Dec 6, 2023 |
| Suse | — | Upgrade go1.20Upgrade go1.21Upgrade go1.21-opensslUpgrade go1.20-openssl-raceUpgrade go1.20-docUpgrade go1.20-opensslUpgrade go1.21-openssl-docUpgrade go1.20-openssl-docUpgrade go1.21-openssl-raceUpgrade go1.20-raceUpgrade go1.21-raceUpgrade go1.21-doc | Dec 12, 2023 | Dec 6, 2023 |
| Ubuntu | — | Upgrade golang-1.20-srcUpgrade golang-1.21Upgrade golang-1.20-goUpgrade golang-1.21-goUpgrade golang-1.20Upgrade golang-1.21-src | Jan 12, 2024 | Dec 6, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub