Description
On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS("C:/tmp").Open("COM1") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. With fix applied, the behavior of os.DirFS("") has changed. Previously, an empty root was treated equivalently to "/", so os.DirFS("").Open("tmp") would open the path "/tmp". This now returns an error.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Go standard library | os | < 1.18.9, 1.19.0-0 – < 1.19.4 | 1.18.9 |
| Go standard library | net/http | < 1.18.9, 1.19.0-0 – < 1.19.4 | 1.18.9 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | golang-1.19 | 1.19.4-1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | container-suseconnect | 2.4.0-150000.4.24.1 | SUSE-SU-2023:0871-1 |
| SLES 15 SP4 | go1.18 | 1.18.9-150000.1.40.1 | SUSE-SU-2022:4398-1 |
| SLES 15 SP4 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SLES 15 SP4 | go1.19 | 1.19.4-150000.1.18.1 | SUSE-SU-2022:4397-1 |
| SLES 15 SP3 | container-suseconnect | 2.4.0-150000.4.24.1 | SUSE-SU-2023:0871-1 |
| SLES 15 SP3 | go1.18 | 1.18.9-150000.1.40.1 | SUSE-SU-2022:4398-1 |
| SLES 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SLES 15 SP3 | go1.19 | 1.19.4-150000.1.18.1 | SUSE-SU-2022:4397-1 |
| SLES 15 SP2 | container-suseconnect | 2.4.0-150000.4.24.1 | SUSE-SU-2023:0871-1 |
| SLES 15 SP1 | container-suseconnect | 2.4.0-150000.4.24.1 | SUSE-SU-2023:0871-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | container-suseconnect | 2.4.0-150000.4.24.1 | SUSE-SU-2023:0871-1 |
| SLES for SAP 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SLES for SAP 15 SP2 | container-suseconnect | 2.4.0-150000.4.24.1 | SUSE-SU-2023:0871-1 |
| SLES for SAP 15 SP1 | container-suseconnect | 2.4.0-150000.4.24.1 | SUSE-SU-2023:0871-1 |
| SLE Real Time 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SLE HPC 15 SP3 | container-suseconnect | 2.4.0-150000.4.24.1 | SUSE-SU-2023:0871-1 |
| SLE HPC 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SLE HPC 15 SP2 | container-suseconnect | 2.4.0-150000.4.24.1 | SUSE-SU-2023:0871-1 |
| SLE HPC 15 SP1 | container-suseconnect | 2.4.0-150000.4.24.1 | SUSE-SU-2023:0871-1 |
| SUSE Enterprise Storage 7.1 | container-suseconnect | 2.4.0-150000.4.24.1 | SUSE-SU-2023:0871-1 |
| SUSE Enterprise Storage 7.1 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SUSE Enterprise Storage 7 | container-suseconnect | 2.4.0-150000.4.24.1 | SUSE-SU-2023:0871-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go1.18 | 1.18.9-1.1 | openSUSE-SU-2024:12552-1 |
| openSUSE Tumbleweed | go1.19 | 1.19.4-1.1 | openSUSE-SU-2024:12553-1 |
| openSUSE Leap 15.5 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| openSUSE Leap 15.4 | go1.18 | 1.18.9-150000.1.40.1 | SUSE-SU-2022:4398-1 |
| openSUSE Leap 15.4 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| openSUSE Leap 15.4 | go1.19 | 1.19.4-150000.1.18.1 | SUSE-SU-2022:4397-1 |
| openSUSE Leap 15.3 | go1.18 | 1.18.9-150000.1.40.1 | SUSE-SU-2022:4398-1 |
| openSUSE Leap 15.3 | go1.19 | 1.19.4-150000.1.18.1 | SUSE-SU-2022:4397-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | delve | 1.9.1-1.0.1.module+el8.7.0+20922+47ac84ba | ELSA-2023-18908 |
| Oracle Linux 8 | go-toolset | 1.19.4-1.module+el8.7.0+20922+47ac84ba | ELSA-2023-18908 |
| Oracle Linux 8 | golang +6 | 1.19.4-2.0.1.module+el8.7.0+20922+47ac84ba | ELSA-2023-18908 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | stdlib | < 1.18.9 · >= 1.19.0-0, < 1.19.4 | 1.18.9, 1.19.4 | GO-2022-1143 |
Advisories 11
- WID-SEC-2023-2031 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2023-1350 Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern BSI CERT-Bund (WID) · Jul 1, 2026
- SUSE-SU-2023:0871-1 Security update for container-suseconnect SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12553-1 go1.19-1.19.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:4398-1 Security update for go1.18 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2312-1 Security update for go1.18-openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:4397-1 Security update for go1.19 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12552-1 go1.18-1.18.9-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2023-0138 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- ELSA-2023-18908 Important: ol8addon security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Mar 7, 2023