Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Summary

Product

Vulnerabilities 2

• Medium 5.3
  CVE-2023-45284

  Incorrect detection of reserved device names on Windows in path/filepath

  On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With …

  Go standard library path/filepath golang stdlib Debian Ubuntu Azure Linux Go
  Nov 9, 2023
• Unscored —
  CVE-2023-45283

  Insecure parsing of Windows paths with a \??\ prefix in path/filepath

  The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the…

  Go standard library path/filepath internal/safefilepath golang Debian Ubuntu Azure Linux Wolfi Go
  Nov 9, 2023

Revision history

1. 2024-10-14 #12

   Neue Updates von Splunk-SVD aufgenommen

2. 2024-08-06 #11

   Neue Updates von Gentoo aufgenommen

3. 2024-07-30 #10

   Neue Updates von IBM aufgenommen

4. 2024-05-20 #9

   Neue Updates von IBM aufgenommen

5. 2024-01-09 #8

   Neue Updates von Amazon aufgenommen

6. 2024-01-08 #7

   Neue Updates von Amazon aufgenommen

7. 2023-12-20 #6

   Neue Updates von SUSE aufgenommen

8. 2023-12-14 #5

   Neue Updates von SUSE aufgenommen

9. 2023-12-11 #4

   Neue Updates von SUSE aufgenommen

10. 2023-11-16 #3

    Neue Updates von SUSE aufgenommen

11. 2023-11-08 #2

    Neue Updates von Go aufgenommen

12. 2023-11-07 #1

    Initiale Fassung

References

• SUSE Security Update SUSE-SU-2023:4708-1 vom 2023-12-11
  https://lists.suse.com/pipermail/sle-security-updates/2023-December/017307.html
• Amazon Linux Security Advisory ALAS-2024-1903 vom 2024-01-09
  https://alas.aws.amazon.com/ALAS-2024-1903.html
• Amazon Linux Security Advisory ALAS-2024-2388 vom 2024-01-10
  https://alas.aws.amazon.com/AL2/ALAS-2024-2388.html
• SUSE Security Update SUSE-SU-2023:4709-1 vom 2023-12-14
  https://lists.suse.com/pipermail/sle-security-updates/2023-December/017389.html
• SUSE Security Update SUSE-SU-2023:4930-1 vom 2023-12-20
  https://lists.suse.com/pipermail/sle-security-updates/2023-December/017504.html
• SUSE Security Update SUSE-SU-2023:4931-1 vom 2023-12-20
  https://lists.suse.com/pipermail/sle-security-updates/2023-December/017503.html
• GitHub Golang vom 2023-11-07
  https://github.com/golang/go/issues/63713
• GitHub Golang vom 2023-11-07
  https://github.com/golang/go/issues/63715
• Go Vulnerability Database GO-2023-2186 vom 2023-11-09
  https://pkg.go.dev/vuln/GO-2023-2186
• Go Vulnerability Database GO-2023-2185 vom 2023-11-09
  https://pkg.go.dev/vuln/GO-2023-2185
• SUSE Security Update SUSE-SU-2023:4470-1 vom 2023-11-16
  https://lists.suse.com/pipermail/sle-security-updates/2023-November/017049.html
• SUSE Security Update SUSE-SU-2023:4469-1 vom 2023-11-16
  https://lists.suse.com/pipermail/sle-security-updates/2023-November/017050.html
• SUSE Security Update SUSE-SU-2023:4472-1 vom 2023-11-16
  https://lists.suse.com/pipermail/sle-security-updates/2023-November/017047.html
• SUSE Security Update SUSE-SU-2023:4471-1 vom 2023-11-16
  https://lists.suse.com/pipermail/sle-security-updates/2023-November/017048.html
• IBM Security Bulletin 7154430 vom 2024-05-20
  https://www.ibm.com/support/pages/node/7154430
• IBM Security Bulletin 7161954 vom 2024-07-30
  https://www.ibm.com/support/pages/node/7161954
• Gentoo Linux Security Advisory GLSA-202408-07 vom 2024-08-07
  https://security.gentoo.org/glsa/202408-07
• Splunk Security Advisory SVD-2024-1012 vom 2024-10-14
  https://advisory.splunk.com//advisories/SVD-2024-1012