CVE-2023-45284

On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://go.dev/cl/540277	Issue Tracking Vendor Advisory
https://go.dev/issue/63713	Issue Tracking Vendor Advisory
https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY	Issue Tracking Mailing List Vendor Advisory
https://pkg.go.dev/vuln/GO-2023-2186	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:golang:go::::::::
	cpe:2.3:a:golang:go::::::::

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-11-09 17:15

Updated : 2023-11-17 16:39

NVD link : CVE-2023-45284

Mitre link : CVE-2023-45284

CVE.ORG link : CVE-2023-45284

JSON object : View

Products Affected

golang

go

microsoft

windows

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-45284", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-11-09T17:15:08.813", "references": [{"url": "https://go.dev/cl/540277", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@golang.org"}, {"url": "https://go.dev/issue/63713", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY", "tags": ["Issue Tracking", "Mailing List", "Vendor Advisory"], "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2023-2186", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@golang.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local."}, {"lang": "es", "value": "En Windows, la funci\u00f3n IsLocal no detecta correctamente los nombres de dispositivos reservados en algunos casos. Los nombres reservados seguidos de espacios, como \"COM1\", y los nombres reservados \"COM\" y \"LPT\" seguidos del super\u00edndice 1, 2 o 3 se informan incorrectamente como locales. Con la soluci\u00f3n, IsLocal ahora informa correctamente estos nombres como no locales."}], "lastModified": "2023-11-17T16:39:27.450", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1E7C289-7484-4AA8-A96B-07D2E2933258", "versionEndExcluding": "1.20.11"}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E3FC16C-41B2-4900-901F-48BDA3DC9ED2", "versionEndExcluding": "1.21.4", "versionStartIncluding": "1.21.0-0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@golang.org"}