onyx --cves cve-2023-45283
CVE-2023-45283
- score
- <0.1
- cvss
- 7.5
- epss
- 2.8%
- published
- 2023-11-09
- kev added
- —
- first seen
The Go filepath package on Windows does not recognize paths with a \??\ prefix as special, leading to incorrect path handling and potential access to arbitrary locations. The fix corrects path conversion, absolute path detection, and volume name reporting, restoring previous behavior in Go 1.20.11 and 1.21.4.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 9
- https://go.dev/cl/541175
- https://go.dev/issue/64028
- https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
- https://go.dev/cl/540277
- https://go.dev/issue/63713
- https://pkg.go.dev/vuln/GO-2023-2185
- https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY
- http://www.openwall.com/lists/oss-security/2023/12/05/2
- https://security.netapp.com/advisory/ntap-20231214-0008/