CVE-2022-23773: cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags

High severity · published Feb 11, 2022

CVE-2022-23773

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags

7.5

CVSS

2.7%

EPSS

On KEV

Description

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.7% · higher than 86% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Beegfs Csi Driver · Netapp

All versions, or not specified · source: NVD

Cloud Insights Telegraf Agent · Netapp

All versions, or not specified · source: NVD

GO · Golang

before 1.16.14; 1.17.0 before 1.17.7 · source: NVD

Kubernetes Monitoring Operator · Netapp

All versions, or not specified · source: NVD

Storagegrid · Netapp

All versions, or not specified · source: NVD

Affected product

Golang

All GO CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-23773

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-23773

Release Notes

https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ

Third Party Advisory

https://security.gentoo.org/glsa/202208-02

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220225-0006/

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html