Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golang-miscUpgrade go-toolsetUpgrade golang-testsUpgrade golangUpgrade golang-docsUpgrade golang-binUpgrade delveUpgrade golang-src | Feb 23, 2024 | Dec 6, 2023 |
| Debian | — | No solution exists | May 15, 2025 | Dec 6, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 8, 2024 | Dec 6, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Mar 13, 2024 | Dec 6, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Mar 13, 2024 | Dec 6, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Mar 18, 2025 | Dec 6, 2023 |
| Oracle_linux | — | Upgrade golang-testsUpgrade golang-srcUpgrade delveUpgrade golang-binUpgrade golang-miscUpgrade golang-docsUpgrade go-toolsetUpgrade golang | Feb 23, 2024 | Dec 6, 2023 |
| Redhat_linux | — | Upgrade go-toolsetUpgrade golang-docsUpgrade delve-debuginfoUpgrade delveUpgrade delve-debugsourceUpgrade golang-testsUpgrade golangUpgrade golang-binUpgrade golang-srcUpgrade golang-misc | Feb 21, 2024 | Dec 6, 2023 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.3Upgrade Splunk Enterprise to version 9.3.1Upgrade Splunk Enterprise to version 9.1.6 | Jul 30, 2026 | Dec 6, 2023 |
| Suse | — | Upgrade go1.20-openssl-raceUpgrade go1.21-opensslUpgrade go1.21Upgrade go1.20-docUpgrade go1.20Upgrade go1.20-raceUpgrade go1.20-openssl-docUpgrade go1.21-openssl-raceUpgrade go1.20-opensslUpgrade go1.21-raceUpgrade go1.21-docUpgrade go1.21-openssl-doc | Dec 12, 2023 | Dec 6, 2023 |
| Ubuntu | — | Upgrade golang-1.20-goUpgrade golang-1.21Upgrade golang-1.20-srcUpgrade golang-1.20Upgrade golang-1.21-goUpgrade golang-1.21-src | Jan 12, 2024 | Dec 6, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub