CVEvulnerability
CVE-2022-23773
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-02-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-436
Description
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
Affected configurations
• golang go (< 1.16.14)
• golang go (>= 1.17.0 < 1.17.7)
• netapp beegfs csi driver
• netapp cloud insights telegraf agent
• netapp kubernetes monitoring operator
• netapp storagegrid
Related
Weakness · CWE (1)
- CWE-436 Interpretation Conflict weakness
References
- https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ Release Notes, Vendor Advisory
- https://security.gentoo.org/glsa/202208-02 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220225-0006/ Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
- https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ Release Notes, Vendor Advisory
- https://security.gentoo.org/glsa/202208-02 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220225-0006/ Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory