CVE-2023-45285 Command 'go get' may unexpectedly fallback to insecure git in cmd/go

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Related to Malicious Git Server Replies Affect Go Applications Two vulnerabilities have been identified in Git server responses affecting Go applications. CVE-2023-49568 can cause denial of service (DoS), while CVE-2023-49569 allows for path traversal and remote code execution (RCE). Both vulnerabilities were published on January 12, 2024. 3 sources 41