PT-2023-7932 · Go+3 · Go+3
Neil
·
Published
2023-11-08
·
Updated
2026-04-21
·
CVE-2023-45284
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Go versions 1.21.3 and earlier, 1.20.10 and earlier
Description
The issue is related to the IsLocal function not correctly detecting reserved device names in some cases on Windows. Specifically, reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. This can be exploited by a remote attacker to bypass existing security restrictions. The estimated number of potentially affected devices is not specified.
Recommendations
For Go versions 1.21.3 and earlier, update to version 1.21.4 or later.
For Go versions 1.20.10 and earlier, update to version 1.20.11 or later.
As a temporary workaround, consider restricting the use of the IsLocal function until a patch is available. Avoid using reserved device names with trailing spaces or superscripts in the
path/filepath package until the issue is resolved.Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Debian
Go
Suse