CVE-2023-45285

A flaw was found in the Golang package cmd/go. This issue permits the fallback to insecure "git://" if trying to fetch a .git module that has no "https://" or "git+ssh://" available.

Red Hat rates this issue as Moderate, as the default configuration avoids this behavior, mitigating the vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This issue only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off). In order to mitigate this, keep GOPROXY with default values and use a module proxy. This vulnerability is not explored with default GOPROXY value.