CVE-2022-23773: High severity IBM Cloud Pak for Security vulnerability
A flaw was found in the go package of the cmd library in golang. The go command could be tricked into accepting a branch, which resembles a version tag. This issue could allow a remote unauthenticated attacker to bypass security restrictions and introduce invalid or incorrect tags, reducing the integrity of the environment.
Other sources
An unspecified error with not treating branches with semantic-version names as releases in cmd/go in Golang Go has an unknown impact and attack vector.
— IBM
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-23773?
CVE-2022-23773 is a vulnerability in the cmd/go package in Go before versions 1.16.14 and 1.17.x before 1.17.7 that can misinterpret branch names and lead to the introduction of invalid or incorrect tags.
What is the severity of CVE-2022-23773?
CVE-2022-23773 has a severity rating of high with a CVSS score of 7.5.
Which software versions are affected by CVE-2022-23773?
CVE-2022-23773 affects Go versions before 1.16.14 and 1.17.x before 1.17.7.
How can CVE-2022-23773 be exploited?
CVE-2022-23773 can be exploited by tricking the go command into accepting a branch that resembles a version tag.
Are there any references for CVE-2022-23773?
Yes, you can find more information about CVE-2022-23773 at the following references: [Reference 1](https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ), [Reference 2](https://security.gentoo.org/glsa/202208-02), [Reference 3](https://security.netapp.com/advisory/ntap-20220225-0006/).