CVE-2023-45283
highPriorität · verfolgen · 31EPSS 0.028 · 86. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.9–7.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (75)
Betroffene Produkte und Versionsbereiche.
Advisories (8)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2023-2856Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2023-11-07csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- WID-SEC-W-2023-3038Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2023-11-30csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- WID-SEC-W-2025-0001IBM DB2: Mehrere SchwachstellenDeutsch2025-01-01csaf · cert_bundDE
Ein entfernter oder lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 on Cloud Pak for Data ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen.
- BIT-golang-2023-45283Insecure parsing of Windows paths with a \??\ prefix in path/filepath2024-03-06vendor · osvUS
The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.
- CGA-25c3-cp9r-6wrx2024-06-06vendor · osvUS
- CGA-qqfg-vr55-6p992024-06-06vendor · osvUS
- CGA-qqg8-j32g-67m92024-06-06vendor · osvUS
- GO-2023-2185Insecure parsing of Windows paths with a \??\ prefix in path/filepath2023-11-08vendor · osvUS
The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.
auch bekannt als (9)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202311-775cnnvd
- EUVD-2023-49584enisa_euvd
- BDU:2023-09013fstec_bdu
- GHSA-vvjp-q62m-2vphenisa_euvd
- BIT-golang-2023-45283osv
- CGA-qqfg-vr55-6p99osv
- CGA-qqg8-j32g-67m9osv
- GHSA-vvjp-q62m-2vphosv
- GO-2023-2185osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (29)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2023/12/05/2cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-45283/cnnvd
- https://github.com/golang/go/releases/tag/go1.21.4Patchcnnvd
- https://go.dev/cl/540277cnnvd
- https://go.dev/cl/541175cnnvd
- https://go.dev/issue/63713cnnvd
- https://go.dev/issue/64028cnnvd
- https://groups.google.com/g/golang-announce/c/4tU8LZfBFkYcnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan