Description
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Go toolchain | cmd/go | < 1.20.12, 1.21.0-0 – < 1.21.5 | 1.20.12 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | golang-1.19 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | golang-1.20 | 1.20.3-1ubuntu0.1~22.04.1 | USN-6574-1 |
| Ubuntu 22.04 LTS | golang-1.21 | 1.21.1-1~ubuntu22.04.2 | USN-6574-1 |
| Ubuntu 20.04 LTS | golang-1.20 | 1.20.3-1ubuntu0.1~20.04.1 | USN-6574-1 |
| Ubuntu 20.04 LTS | golang-1.21 | 1.21.1-1~ubuntu20.04.2 | USN-6574-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | golang +6 | 1.20.12-1.el9_3 | RHSA-2024:1131 |
| RHEL 8 | delve | 1.20.2-1.module+el8.9.0+18926+5193682d | RHSA-2024:0887 |
| RHEL 8 | go-toolset | 1.20.12-1.module+el8.9.0+21033+5795bdf6 | RHSA-2024:0887 |
| RHEL 8 | golang +5 | 1.20.12-2.module+el8.9.0+21033+5795bdf6 | RHSA-2024:0887 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Devtools 2023 | go-toolset-1.19-golang +6 | 1.19.13-5.el7_9 | RHSA-2024:1041 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | golang +6 | 1.20.12-1.el9_3 | ALSA-2024:1131 |
| AlmaLinux 8 | delve | 1.20.2-1.module_el8.9.0+3642+43318da8 | ALSA-2024:0887 |
| AlmaLinux 8 | go-toolset | 1.20.12-1.module_el8.9.0+3728+f1d47c6f | ALSA-2024:0887 |
| AlmaLinux 8 | golang +5 | 1.20.12-2.module_el8.9.0+3728+f1d47c6f | ALSA-2024:0887 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | go1.20 | 1.20.12-150000.1.35.1 | SUSE-SU-2023:4708-1 |
| SLES 15 SP5 | go1.20-openssl | 1.20.12.1-150000.1.17.1 | SUSE-SU-2023:4930-1 |
| SLES 15 SP5 | go1.21 | 1.21.5-150000.1.18.1 | SUSE-SU-2023:4709-1 |
| SLES 15 SP5 | go1.21-openssl | 1.21.5.1-150000.1.8.1 | SUSE-SU-2023:4931-1 |
| SLES 15 SP4 | go1.20 | 1.20.12-150000.1.35.1 | SUSE-SU-2023:4708-1 |
| SLES 15 SP4 | go1.20-openssl | 1.20.12.1-150000.1.17.1 | SUSE-SU-2023:4930-1 |
| SLES 15 SP4 | go1.21 | 1.21.5-150000.1.18.1 | SUSE-SU-2023:4709-1 |
| SLES 15 SP4 | go1.21-openssl | 1.21.5.1-150000.1.8.1 | SUSE-SU-2023:4931-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go1.20 | 1.20.12-1.1 | openSUSE-SU-2024:13491-1 |
| openSUSE Tumbleweed | go1.21 | 1.21.5-1.1 | openSUSE-SU-2024:13492-1 |
| openSUSE Leap 15.5 | go1.20 | 1.20.12-150000.1.35.1 | SUSE-SU-2023:4708-1 |
| openSUSE Leap 15.5 | go1.20-openssl | 1.20.12.1-150000.1.17.1 | SUSE-SU-2023:4930-1 |
| openSUSE Leap 15.5 | go1.21 | 1.21.5-150000.1.18.1 | SUSE-SU-2023:4709-1 |
| openSUSE Leap 15.5 | go1.21-openssl | 1.21.5.1-150000.1.8.1 | SUSE-SU-2023:4931-1 |
| openSUSE Leap 15.4 | go1.20 | 1.20.12-150000.1.35.1 | SUSE-SU-2023:4708-1 |
| openSUSE Leap 15.4 | go1.20-openssl | 1.20.12.1-150000.1.17.1 | SUSE-SU-2023:4930-1 |
| openSUSE Leap 15.4 | go1.21 | 1.21.5-150000.1.18.1 | SUSE-SU-2023:4709-1 |
| openSUSE Leap 15.4 | go1.21-openssl | 1.21.5.1-150000.1.8.1 | SUSE-SU-2023:4931-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | golang | 1.21.6-1 | — |
| Azure Linux 2 (CBL-Mariner) | msft-golang | 1.22.3-1. | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | golang +6 | 1.20.12-1.el9_3 | ELSA-2024-1131 |
| Oracle Linux 8 | delve | 1.20.2-1.0.1.module+el8.9.0+90001+52c302fe | ELSA-2024-0887 |
| Oracle Linux 8 | golang +6 | 1.20.12-1.module+el8.9.0+90156+2bd6b1a8 | ELSA-2024-0887 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | aactl | 0.4.12-r5 | — |
| Wolfi rolling | amass | 4.2.0-r3 | — |
| Wolfi rolling | aws-flb-cloudwatch | 1.9.4-r6 | — |
| Wolfi rolling | aws-flb-firehose | 1.7.2-r6 | — |
| Wolfi rolling | aws-flb-kinesis | 1.10.2-r6 | — |
| Wolfi rolling | cass-operator | 1.18.2-r3 | — |
| Wolfi rolling | cni-plugins | 1.4.0-r1 | — |
| Wolfi rolling | configmap-reload | 0.12.0-r3 | — |
| Wolfi rolling | cortex | 1.16.0-r1 | — |
| Wolfi rolling | ctop | 0.7.7-r10 | — |
| Wolfi rolling | dgraph | 23.1.0-r4 | — |
| Wolfi rolling | docker-cli | 24.0.6-r1 | — |
| Wolfi rolling | docker-credential-ecr-login | 0.7.1-r8 | — |
| Wolfi rolling | flannel-cni-plugin | 1.2.0-r5 | — |
| Wolfi rolling | gke-gcloud-auth-plugin | 0.0.2-r6 | — |
| Wolfi rolling | go-bindata | 3.1.3-r15 | — |
| Wolfi rolling | go-licenses | 1.6.0-r8 | — |
| Wolfi rolling | go-md2man | 2.0.3-r1 | — |
| Wolfi rolling | gobuster | 3.6.0-r4 | — |
| Wolfi rolling | gops | 0.3.28-r4 | — |
| Wolfi rolling | gosu | 1.17-r2 | — |
| Wolfi rolling | grpcurl | 1.8.9-r2 | — |
| Wolfi rolling | helm-push | 0.10.4-r1 | — |
| Wolfi rolling | hey | 0.1.4-r9 | — |
| Wolfi rolling | hubble-ui-backend | 0.13.3-r1 | — |
| Wolfi rolling | influx | 2.7.3-r8 | — |
| Wolfi rolling | ip-masq-agent | 2.9.3-r6 | — |
| Wolfi rolling | k3d | 5.6.0-r5 | — |
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | kind | 0.21.0-r0 | — |
| Wolfi rolling | kubernetes-dashboard-metrics-scraper +1 | 1.0.9-r10 | — |
| Wolfi rolling | local-path-provisioner | 0.0.26-r2 | — |
| Wolfi rolling | mage | 1.15.0-r4 | — |
| Wolfi rolling | metrics-server | 0.6.4-r8 | — |
| Wolfi rolling | nats | 0.1.1-r4 | — |
| Wolfi rolling | nri-discovery-kubernetes | 1.7.2-r2 | — |
| Wolfi rolling | nsc | 2.8.5-r1 | — |
| Wolfi rolling | oras | 1.1.0-r4 | — |
| Wolfi rolling | petname | 2.11-r3 | — |
| Wolfi rolling | protoc-gen-go-grpc | 1.3.0-r7 | — |
| Wolfi rolling | render-template | 1.0.6-r1 | — |
| Wolfi rolling | sbom-scorecard | 0.0.7-r6 | — |
| Wolfi rolling | scorecard | 4.13.1-r1 | — |
| Wolfi rolling | slsa-verifier | 2.4.1-r1 | — |
| Wolfi rolling | smarter-device-manager | 1.20.11-r3 | — |
| Wolfi rolling | sonobuoy | 0.57.1-r1 | — |
| Wolfi rolling | sops | 3.8.1-r1 | — |
| Wolfi rolling | vertical-pod-autoscaler | 1.0.0-r2 | — |
| Wolfi rolling | wait-for-port | 1.0.7-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | toolchain | < 1.20.12 · >= 1.21.0-0, < 1.21.5 | 1.20.12, 1.21.5 | GO-2023-2383 |
Advisories 16
- ALSA-2024:1131 Moderate: golang security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:0887 Moderate: go-toolset:rhel8 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:1131 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:1041 Red Hat Security Advisory: go-toolset-1.19-golang security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:0887 Red Hat Security Advisory: go-toolset:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- USN-6574-1 Go vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2024:13492-1 go1.21-1.21.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4709-1 Security update for go1.21 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4931-1 Security update for go1.21-openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13491-1 go1.20-1.20.12-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4930-1 Security update for go1.20-openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4708-1 Security update for go1.20 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1248 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
- WID-SEC-2023-3038 Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 14, 2024
- ELSA-2024-1131 Moderate: golang security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Mar 6, 2024
- ELSA-2024-0887 Moderate: go-toolset:ol8 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 22, 2024