{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-45284", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2023-10-06T17:06:26.220Z", "datePublished": "2023-11-09T16:30:15.250Z", "dateUpdated": "2024-09-03T19:00:47.531Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2023-11-09T16:30:15.250Z"}, "title": "Incorrect detection of reserved device names on Windows in path/filepath", "descriptions": [{"lang": "en", "value": "On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local."}], "affected": [{"vendor": "Go standard library", "product": "path/filepath", "collectionURL": "https://pkg.go.dev", "packageName": "path/filepath", "versions": [{"version": "0", "lessThan": "1.20.11", "status": "affected", "versionType": "semver"}, {"version": "1.21.0-0", "lessThan": "1.21.4", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "IsLocal"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-41: Improper Resolution of Path Equivalence"}]}], "references": [{"url": "https://go.dev/issue/63713"}, {"url": "https://go.dev/cl/540277"}, {"url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY"}, {"url": "https://pkg.go.dev/vuln/GO-2023-2186"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:21:15.204Z"}, "title": "CVE Program Container", "references": [{"url": "https://go.dev/issue/63713", "tags": ["x_transferred"]}, {"url": "https://go.dev/cl/540277", "tags": ["x_transferred"]}, {"url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY", "tags": ["x_transferred"]}, {"url": "https://pkg.go.dev/vuln/GO-2023-2186", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "golang", "product": "go", "cpes": ["cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThan": "1.20.11", "versionType": "semver"}, {"version": "1.21.0-0", "status": "affected", "lessThan": "1.21.4", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-09-03T18:55:41.107810Z", "id": "CVE-2023-45284", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-03T19:00:47.531Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://go.dev/issue/63713", "tags": ["x_transferred"]}, {"url": "https://go.dev/cl/540277", "tags": ["x_transferred"]}, {"url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY", "tags": ["x_transferred"]}, {"url": "https://pkg.go.dev/vuln/GO-2023-2186", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:21:15.204Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-45284", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-03T18:55:41.107810Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"], "vendor": "golang", "product": "go", "versions": [{"status": "affected", "version": "0", "lessThan": "1.20.11", "versionType": "semver"}, {"status": "affected", "version": "1.21.0-0", "lessThan": "1.21.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-03T18:58:19.047Z"}}], "cna": {"title": "Incorrect detection of reserved device names on Windows in path/filepath", "affected": [{"vendor": "Go standard library", "product": "path/filepath", "versions": [{"status": "affected", "version": "0", "lessThan": "1.20.11", "versionType": "semver"}, {"status": "affected", "version": "1.21.0-0", "lessThan": "1.21.4", "versionType": "semver"}], "packageName": "path/filepath", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "IsLocal"}]}], "references": [{"url": "https://go.dev/issue/63713"}, {"url": "https://go.dev/cl/540277"}, {"url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY"}, {"url": "https://pkg.go.dev/vuln/GO-2023-2186"}], "descriptions": [{"lang": "en", "value": "On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-41: Improper Resolution of Path Equivalence"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2023-11-09T16:30:15.250Z"}}}, "cveMetadata": {"cveId": "CVE-2023-45284", "state": "PUBLISHED", "dateUpdated": "2024-09-03T19:00:47.531Z", "dateReserved": "2023-10-06T17:06:26.220Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2023-11-09T16:30:15.250Z", "assignerShortName": "Go"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1E7C289-7484-4AA8-A96B-07D2E2933258", "versionEndExcluding": "1.20.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E3FC16C-41B2-4900-901F-48BDA3DC9ED2", "versionEndExcluding": "1.21.4", "versionStartIncluding": "1.21.0-0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local."}, {"lang": "es", "value": "En Windows, la funci\u00f3n IsLocal no detecta correctamente los nombres de dispositivos reservados en algunos casos. Los nombres reservados seguidos de espacios, como \"COM1\", y los nombres reservados \"COM\" y \"LPT\" seguidos del super\u00edndice 1, 2 o 3 se informan incorrectamente como locales. Con la soluci\u00f3n, IsLocal ahora informa correctamente estos nombres como no locales."}], "id": "CVE-2023-45284", "lastModified": "2024-11-21T08:26:41.737", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-11-09T17:15:08.813", "references": [{"source": "security@golang.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://go.dev/cl/540277"}, {"source": "security@golang.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://go.dev/issue/63713"}, {"source": "security@golang.org", "tags": ["Issue Tracking", "Mailing List", "Vendor Advisory"], "url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY"}, {"source": "security@golang.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2023-2186"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://go.dev/cl/540277"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://go.dev/issue/63713"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Mailing List", "Vendor Advisory"], "url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2023-2186"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}