CVE-2022-23773

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect...

Original description

The description as published by the source.

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.14"},{"introduced":"1.17.0"},{"fixed":"1.17.7"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2022-23773 golang-1.15 Fixed in: 1.15.15-1~deb11u3

References

advisory groups.google.com
advisory security.gentoo.org
advisory security.netapp.com
advisory oracle.com
web nvd.nist.gov