Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade go-toolsetUpgrade golang-miscUpgrade delveUpgrade golangUpgrade golang-testsUpgrade golang-binUpgrade golang-docsUpgrade golang-src | Feb 23, 2024 | Dec 6, 2023 |
| Debian | — | No solution exists | May 15, 2025 | Dec 6, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 8, 2024 | Dec 6, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Mar 13, 2024 | Dec 6, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Mar 13, 2024 | Dec 6, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Mar 18, 2025 | Dec 6, 2023 |
| Oracle_linux | — | Upgrade golang-testsUpgrade golang-srcUpgrade golang-binUpgrade delveUpgrade go-toolsetUpgrade golang-docsUpgrade golang-miscUpgrade golang | Feb 23, 2024 | Dec 6, 2023 |
| Redhat_linux | — | Upgrade delveUpgrade golang-docsUpgrade go-toolsetUpgrade delve-debuginfoUpgrade golang-miscUpgrade delve-debugsourceUpgrade golang-srcUpgrade golangUpgrade golang-binUpgrade golang-tests | Feb 21, 2024 | Dec 6, 2023 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.1Upgrade Splunk Enterprise to version 9.2.3Upgrade Splunk Enterprise to version 9.1.6 | Jul 30, 2026 | Dec 6, 2023 |
| Suse | — | Upgrade go1.20-opensslUpgrade go1.21-raceUpgrade go1.21-docUpgrade go1.21-openssl-docUpgrade go1.20-raceUpgrade go1.20-openssl-docUpgrade go1.21-openssl-raceUpgrade go1.21Upgrade go1.21-opensslUpgrade go1.20-docUpgrade go1.20-openssl-raceUpgrade go1.20 | Dec 12, 2023 | Dec 6, 2023 |
| Ubuntu | — | Upgrade golang-1.20-srcUpgrade golang-1.20-goUpgrade golang-1.21Upgrade golang-1.21-srcUpgrade golang-1.21-goUpgrade golang-1.20 | Jan 12, 2024 | Dec 6, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub