Input validation error in Go programming language - CVE-2023-45284

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU83254

Input validation error in Go programming language - CVE-2023-45284

Published: November 17, 2023


Vulnerability identifier: #VU83254
CSH Severity: Low
CVSS v4 BT: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-45284
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to the IsLocal() function from the path/filepath package does not correctly detect reserved device names in some cases when executed on Windows. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. A local user can abuse such behavior and bypass implemented security restrictions.


Affected software

Go programming language
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
Development Tools Module
openSUSE Leap
Consul Enterprise
IBM Cloud Transformation Advisor
IBM Concert Software
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Robotic Process Automation
Splunk Enterprise
Db2 Rest
DB2 on Cloud Pak for Data
Storage Protect Plus Server
Robotic Process Automation for Cloud Pak
go1.20-openssl-debuginfo
go1.20-openssl-doc
go1.20-openssl
go1.20-openssl-race
go1.20-race
go1.20-debuginfo
go1.20
go1.20-doc
golang
go1.21-openssl
go1.21-openssl-race
go1.21-openssl-doc
go1.21-race
go1.21
go1.21-doc
IBM CICS TX Standard

How to mitigate CVE-2023-45284

Install updates from vendor's website.

Go programming language - addressed in versions 1.20.11, 1.21.4
Consul Enterprise - addressed in versions 1.15.8, 1.16.4, 1.17.1
IBM Cloud Transformation Advisor - update to 3.10.2
Splunk Enterprise - addressed in versions 9.1.6, 9.2.3, 9.3.1
Db2 Rest - update to 1.0.0.301
IBM Concert Software - update to 1.0.1
go1.20-openssl-debuginfo - addressed in versions 1.20.11.1-150000.1.14.1, 1.20.12.1-150000.1.17.1
go1.20-openssl-doc - addressed in versions 1.20.11.1-150000.1.14.1, 1.20.12.1-150000.1.17.1
go1.20-openssl - addressed in versions 1.20.11.1-150000.1.14.1, 1.20.12.1-150000.1.17.1
go1.20-openssl-race - addressed in versions 1.20.11.1-150000.1.14.1, 1.20.12.1-150000.1.17.1
go1.20-race - addressed in versions 1.20.11-150000.1.32.1, 1.20.12-150000.1.35.1
go1.20-debuginfo - addressed in versions 1.20.11-150000.1.32.1, 1.20.12-150000.1.35.1
go1.20 - addressed in versions 1.20.11-150000.1.32.1, 1.20.12-150000.1.35.1
go1.20-doc - addressed in versions 1.20.11-150000.1.32.1, 1.20.12-150000.1.35.1
golang - update to 1.20.12-1.49
go1.21-openssl - addressed in versions 1.21.4.1-150000.1.5.1, 1.21.5.1-150000.1.8.1
go1.21-openssl-race - addressed in versions 1.21.4.1-150000.1.5.1, 1.21.5.1-150000.1.8.1
go1.21-openssl-doc - addressed in versions 1.21.4.1-150000.1.5.1, 1.21.5.1-150000.1.8.1
go1.21-race - addressed in versions 1.21.4-150000.1.15.1, 1.21.5-150000.1.18.1
go1.21 - addressed in versions 1.21.4-150000.1.15.1, 1.21.5-150000.1.18.1
go1.21-doc - addressed in versions 1.21.4-150000.1.15.1, 1.21.5-150000.1.18.1
DB2 on Cloud Pak for Data - update to 4.8.4
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.5
Storage Protect Plus Server - update to 10.1.16.2
IBM CICS TX Standard - update to 11.1.0.0 ifix18
IBM Robotic Process Automation - addressed in versions 21.0.7.15, 23.0.15
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.15, 23.0.15

External References

Related Security Bulletins