Skip to content
OpenAdvisories

Description

The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.

Affected products

VendorProductAffectedFixed
Go standard library path/filepath < 1.20.11, 1.21.0-0 – < 1.21.4, 1.20.11 – < 1.20.12, 1.21.4 – < 1.21.5 1.20.11
Go standard library internal/safefilepath < 1.20.11, 1.21.0-0 – < 1.21.4 1.20.11

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 12 golang-1.19 No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS golang-1.17 +1 No fix yet —
Ubuntu 20.04 LTS golang-1.13 +2 No fix yet —
Ubuntu 18.04 LTS golang-1.8 +2 No fix yet —
Ubuntu 16.04 LTS golang-1.6 +1 No fix yet —
Ubuntu 14.04 LTS golang-1.10 No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS golang-1.13 No fix yet —
Ubuntu Pro 20.04 LTS golang-1.16 No fix yet —
Ubuntu Pro 18.04 LTS golang-1.13 +2 No fix yet —
Ubuntu Pro 16.04 LTS golang-1.13 +1 No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP5 go1.20 1.20.11-150000.1.32.1 SUSE-SU-2023:4470-1
SLES 15 SP5 go1.20-openssl 1.20.11.1-150000.1.14.1 SUSE-SU-2023:4472-1
SLES 15 SP5 go1.21 1.21.4-150000.1.15.1 SUSE-SU-2023:4471-1
SLES 15 SP5 go1.21-openssl 1.21.4.1-150000.1.5.1 SUSE-SU-2023:4469-1
SLES 15 SP4 go1.20 1.20.11-150000.1.32.1 SUSE-SU-2023:4470-1
SLES 15 SP4 go1.20-openssl 1.20.11.1-150000.1.14.1 SUSE-SU-2023:4472-1
SLES 15 SP4 go1.21 1.21.4-150000.1.15.1 SUSE-SU-2023:4471-1
SLES 15 SP4 go1.21-openssl 1.21.4.1-150000.1.5.1 SUSE-SU-2023:4469-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.20 1.20.11-1.1 openSUSE-SU-2024:13406-1
openSUSE Tumbleweed go1.21 1.21.4-1.1 openSUSE-SU-2024:13407-1
openSUSE Tumbleweed traefik 2.10.7-1.1 openSUSE-SU-2024:13506-1
openSUSE Tumbleweed traefik2 2.11.5-1.1 openSUSE-SU-2024:14076-1
openSUSE Leap 15.5 go1.20 1.20.11-150000.1.32.1 SUSE-SU-2023:4470-1
openSUSE Leap 15.5 go1.20-openssl 1.20.11.1-150000.1.14.1 SUSE-SU-2023:4472-1
openSUSE Leap 15.5 go1.21 1.21.4-150000.1.15.1 SUSE-SU-2023:4471-1
openSUSE Leap 15.5 go1.21-openssl 1.21.4.1-150000.1.5.1 SUSE-SU-2023:4469-1
openSUSE Leap 15.4 go1.20 1.20.11-150000.1.32.1 SUSE-SU-2023:4470-1
openSUSE Leap 15.4 go1.20-openssl 1.20.11.1-150000.1.14.1 SUSE-SU-2023:4472-1
openSUSE Leap 15.4 go1.21 1.21.4-150000.1.15.1 SUSE-SU-2023:4471-1
openSUSE Leap 15.4 go1.21-openssl 1.21.4.1-150000.1.5.1 SUSE-SU-2023:4469-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 golang +6 1.20.12-1.amzn2023.0.1 ALAS2023-2024-477
Amazon Linux 2 golang +6 1.20.12-1.amzn2.0.1 ALAS2-2024-2388

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang No fix yet —
Azure Linux 2 (CBL-Mariner) golang 1.21.6-1 —
Azure Linux 2 (CBL-Mariner) msft-golang 1.20.11-1 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling go-1.20 1.20.12-r0 —
Wolfi rolling go-1.21 1.21.5-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.20.11 · >= 1.21.0-0, < 1.21.4 1.20.11, 1.21.4 GO-2023-2185
Go stdlib >= 1.20.11, < 1.20.12 · >= 1.21.4, < 1.21.5 1.20.12, 1.21.5 GO-2023-2185

Advisories 13

References