CVE-2023-45284: falha de média gravidade em Go standard library path/filepath
Incorrect detection of reserved device names on Windows in path/filepath
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 1.1%
On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Go standard library · path/filepathCVEs relacionadas — Go standard library path/filepath
No mesmo produto, das mais perigosas para as menos.
CVE-2023-45283—Insecure parsing of Windows paths with a \??\ prefix in path/filepathEPSS 3.3%CVE-2022-29804—Path traversal via Clean on Windows in path/filepathEPSS 2.4%CVE-2022-30632—Stack exhaustion on crafted paths in path/filepathEPSS 2.2%CVE-2022-41722—Path traversal on Windows in path/filepathEPSS 1.7%CVE-2024-8244LOWWalk/WalkDir in path/filepath susceptible to symlink raceEPSS 0.2%