cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
References
| Link | Resource |
|---|---|
| https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ | Release Notes Vendor Advisory |
| https://security.gentoo.org/glsa/202208-02 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20220225-0006/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujul2022.html | Third Party Advisory |
| https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ | Release Notes Vendor Advisory |
| https://security.gentoo.org/glsa/202208-02 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20220225-0006/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujul2022.html | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 06:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ - Release Notes, Vendor Advisory | |
| References | () https://security.gentoo.org/glsa/202208-02 - Third Party Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20220225-0006/ - Third Party Advisory | |
| References | () https://www.oracle.com/security-alerts/cpujul2022.html - Third Party Advisory |
08 Aug 2023, 14:22
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-436 |
Information
Published : 2022-02-11 01:15
Updated : 2024-11-21 06:49
NVD link : CVE-2022-23773
Mitre link : CVE-2022-23773
CVE.ORG link : CVE-2022-23773
JSON object : View
Products Affected
golang
- go
netapp
- beegfs_csi_driver
- kubernetes_monitoring_operator
- cloud_insights_telegraf_agent
- storagegrid
CWE
CWE-436
Interpretation Conflict