{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-45284", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2023-10-06T17:06:26.220Z", "datePublished": "2023-11-09T16:30:15.250Z", "dateUpdated": "2023-11-09T16:30:15.250Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2023-11-09T16:30:15.250Z"}, "title": "Incorrect detection of reserved device names on Windows in path/filepath", "descriptions": [{"lang": "en", "value": "On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local."}], "affected": [{"vendor": "Go standard library", "product": "path/filepath", "collectionURL": "https://pkg.go.dev", "packageName": "path/filepath", "versions": [{"version": "0", "lessThan": "1.20.11", "status": "affected", "versionType": "semver"}, {"version": "1.21.0-0", "lessThan": "1.21.4", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "IsLocal"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-41: Improper Resolution of Path Equivalence"}]}], "references": [{"url": "https://go.dev/issue/63713"}, {"url": "https://go.dev/cl/540277"}, {"url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY"}, {"url": "https://pkg.go.dev/vuln/GO-2023-2186"}]}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1E7C289-7484-4AA8-A96B-07D2E2933258", "versionEndExcluding": "1.20.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E3FC16C-41B2-4900-901F-48BDA3DC9ED2", "versionEndExcluding": "1.21.4", "versionStartIncluding": "1.21.0-0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local."}, {"lang": "es", "value": "En Windows, la funci\u00f3n IsLocal no detecta correctamente los nombres de dispositivos reservados en algunos casos. Los nombres reservados seguidos de espacios, como \"COM1\", y los nombres reservados \"COM\" y \"LPT\" seguidos del super\u00edndice 1, 2 o 3 se informan incorrectamente como locales. Con la soluci\u00f3n, IsLocal ahora informa correctamente estos nombres como no locales."}], "id": "CVE-2023-45284", "lastModified": "2023-11-17T16:39:27.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-11-09T17:15:08.813", "references": [{"source": "security@golang.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://go.dev/cl/540277"}, {"source": "security@golang.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://go.dev/issue/63713"}, {"source": "security@golang.org", "tags": ["Issue Tracking", "Mailing List", "Vendor Advisory"], "url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY"}, {"source": "security@golang.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2023-2186"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}