Incorrect detection of reserved device names on Windows in p…(CVE-2023-45284)

概要

Incorrect detection of reserved device names on Windows in path/filepath

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.20.11"},{"introduced":"1.21.0-0"},{"fixed":"1.21.4"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2023-45284 golang-1.15
Ubuntu UBUNTU-CVE-2023-45284 golang-1.10

参照URL

advisory nvd.nist.gov
advisory github.com
web go.dev
web go.dev
web groups.google.com
web pkg.go.dev
web pkg.go.dev