CVE-2023-45284 - Vulnerability Details - OpenCVE

On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Golang	Go
Microsoft	Windows

Configuration 1 [-]

AND

OR	cpe:2.3:a:golang:go::::::::
	cpe:2.3:a:golang:go::::::::

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://go.dev/cl/540277
https://go.dev/issue/63713
https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY
https://pkg.go.dev/vuln/GO-2023-2186

History

No history.

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2023-11-09T16:30:15.250Z

Updated: 2024-09-03T19:00:47.531Z

Reserved: 2023-10-06T17:06:26.220Z

Link: CVE-2023-45284

Vulnrichment

Updated: 2024-08-02T20:21:15.204Z

NVD

Status : Modified

Published: 2023-11-09T17:15:08.813

Modified: 2024-11-21T08:26:41.737

Link: CVE-2023-45284

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-45284", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2023-10-06T17:06:26.220Z", "datePublished": "2023-11-09T16:30:15.250Z", "dateUpdated": "2024-09-03T19:00:47.531Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2023-11-09T16:30:15.250Z"}, "title": "Incorrect detection of reserved device names on Windows in path/filepath", "descriptions": [{"lang": "en", "value": "On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local."}], "affected": [{"vendor": "Go standard library", "product": "path/filepath", "collectionURL": "https://pkg.go.dev", "packageName": "path/filepath", "versions": [{"version": "0", "lessThan": "1.20.11", "status": "affected", "versionType": "semver"}, {"version": "1.21.0-0", "lessThan": "1.21.4", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "IsLocal"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-41: Improper Resolution of Path Equivalence"}]}], "references": [{"url": "https://go.dev/issue/63713"}, {"url": "https://go.dev/cl/540277"}, {"url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY"}, {"url": "https://pkg.go.dev/vuln/GO-2023-2186"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:21:15.204Z"}, "title": "CVE Program Container", "references": [{"url": "https://go.dev/issue/63713", "tags": ["x_transferred"]}, {"url": "https://go.dev/cl/540277", "tags": ["x_transferred"]}, {"url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY", "tags": ["x_transferred"]}, {"url": "https://pkg.go.dev/vuln/GO-2023-2186", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "golang", "product": "go", "cpes": ["cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThan": "1.20.11", "versionType": "semver"}, {"version": "1.21.0-0", "status": "affected", "lessThan": "1.21.4", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-09-03T18:55:41.107810Z", "id": "CVE-2023-45284", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-03T19:00:47.531Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://go.dev/issue/63713", "tags": ["x_transferred"]}, {"url": "https://go.dev/cl/540277", "tags": ["x_transferred"]}, {"url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY", "tags": ["x_transferred"]}, {"url": "https://pkg.go.dev/vuln/GO-2023-2186", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:21:15.204Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-45284", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-03T18:55:41.107810Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"], "vendor": "golang", "product": "go", "versions": [{"status": "affected", "version": "0", "lessThan": "1.20.11", "versionType": "semver"}, {"status": "affected", "version": "1.21.0-0", "lessThan": "1.21.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-03T18:58:19.047Z"}}], "cna": {"title": "Incorrect detection of reserved device names on Windows in path/filepath", "affected": [{"vendor": "Go standard library", "product": "path/filepath", "versions": [{"status": "affected", "version": "0", "lessThan": "1.20.11", "versionType": "semver"}, {"status": "affected", "version": "1.21.0-0", "lessThan": "1.21.4", "versionType": "semver"}], "packageName": "path/filepath", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "IsLocal"}]}], "references": [{"url": "https://go.dev/issue/63713"}, {"url": "https://go.dev/cl/540277"}, {"url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY"}, {"url": "https://pkg.go.dev/vuln/GO-2023-2186"}], "descriptions": [{"lang": "en", "value": "On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-41: Improper Resolution of Path Equivalence"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2023-11-09T16:30:15.250Z"}}}, "cveMetadata": {"cveId": "CVE-2023-45284", "state": "PUBLISHED", "dateUpdated": "2024-09-03T19:00:47.531Z", "dateReserved": "2023-10-06T17:06:26.220Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2023-11-09T16:30:15.250Z", "assignerShortName": "Go"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1E7C289-7484-4AA8-A96B-07D2E2933258", "versionEndExcluding": "1.20.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E3FC16C-41B2-4900-901F-48BDA3DC9ED2", "versionEndExcluding": "1.21.4", "versionStartIncluding": "1.21.0-0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local."}, {"lang": "es", "value": "En Windows, la funci\u00f3n IsLocal no detecta correctamente los nombres de dispositivos reservados en algunos casos. Los nombres reservados seguidos de espacios, como \"COM1\", y los nombres reservados \"COM\" y \"LPT\" seguidos del super\u00edndice 1, 2 o 3 se informan incorrectamente como locales. Con la soluci\u00f3n, IsLocal ahora informa correctamente estos nombres como no locales."}], "id": "CVE-2023-45284", "lastModified": "2024-11-21T08:26:41.737", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-11-09T17:15:08.813", "references": [{"source": "security@golang.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://go.dev/cl/540277"}, {"source": "security@golang.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://go.dev/issue/63713"}, {"source": "security@golang.org", "tags": ["Issue Tracking", "Mailing List", "Vendor Advisory"], "url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY"}, {"source": "security@golang.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2023-2186"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://go.dev/cl/540277"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://go.dev/issue/63713"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Mailing List", "Vendor Advisory"], "url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2023-2186"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}