BIT-golang-2023-45284

vendorUSosv

Incorrect detection of reserved device names on Windows in path/filepath

Advisory ansehen veröffentlicht 2024-03-06Lizenz: per source

On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

beschreibt (1)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2023-45284US	medium5.3	0.90% (60th)	—	2023-11-09
On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LP…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

https://go.dev/cl/540277ADVISORY
https://go.dev/issue/63713ADVISORY
https://groups.google.com/g/golang-announce/c/4tU8LZfBFkYADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2023-45284WEB
https://pkg.go.dev/vuln/GO-2023-2186ADVISORY

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan