CVE-2024-45340
Fixed in a distro release EPSS <1%CVSS 8.8
Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.
Products: Go toolchain cmd/go
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | toolchain | 1.24.0-rc.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 13 | golang-1.24 | 1.24~rc2-1 |
| SUSE Enterprise Storage 7.1 | go1.24 | 1.24rc2-150000.1.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | go1.24 | 1.24rc2-150000.1.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | go1.24 | 1.24rc2-150000.1.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | go1.24 | 1.24rc2-150000.1.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | go1.24 | 1.24rc2-150000.1.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | go1.24 | 1.24rc2-150000.1.3.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP6 | go1.24 | 1.24rc2-150000.1.3.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0.0.20250207T224745-150000.1.32.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0.0.20250128T150132-150000.1.29.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | go1.24 | 1.24rc2-150000.1.3.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | go1.24 | 1.24rc2-150000.1.3.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | go1.24 | 1.24rc2-150000.1.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | go1.24 | 1.24rc2-150000.1.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | go1.24 | 1.24rc2-150000.1.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | go1.24 | 1.24rc2-150000.1.3.1 |
| Ubuntu 14.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.6 | no fix |
| Ubuntu 18.04 LTS | golang-1.10 | no fix |
| Ubuntu 18.04 LTS | golang-1.8 | no fix |
| Ubuntu 18.04 LTS | golang-1.9 | no fix |
| Ubuntu 20.04 LTS | golang-1.13 | no fix |
| Ubuntu 20.04 LTS | golang-1.14 | no fix |
| Ubuntu 20.04 LTS | golang-1.18 | no fix |
| Ubuntu 20.04 LTS | golang-1.20 | no fix |
| Ubuntu 20.04 LTS | golang-1.21 | no fix |
| Ubuntu 20.04 LTS | golang-1.22 | no fix |
| Ubuntu 22.04 LTS | golang-1.17 | no fix |
| Ubuntu 22.04 LTS | golang-1.18 | no fix |
| Ubuntu 22.04 LTS | golang-1.20 | no fix |
| Ubuntu 22.04 LTS | golang-1.21 | no fix |
| Ubuntu 24.04 LTS | golang-1.21 | no fix |
| Ubuntu 24.04 LTS | golang-1.23 | no fix |
| Ubuntu 24.04 LTS | golang-1.24 | no fix |
| Ubuntu 25.10 | golang-1.23 | no fix |
| Ubuntu 25.10 | golang-1.24 | no fix |
| Ubuntu 26.04 LTS | golang-1.23 | no fix |
| Ubuntu 26.04 LTS | golang-1.24 | no fix |
| Ubuntu Pro 16.04 LTS | golang-1.13 | no fix |
| Ubuntu Pro 16.04 LTS | golang-1.18 | no fix |
| Ubuntu Pro 18.04 LTS | golang-1.13 | no fix |
| Ubuntu Pro 18.04 LTS | golang-1.16 | no fix |
| Ubuntu Pro 18.04 LTS | golang-1.18 | no fix |
| Ubuntu Pro 20.04 LTS | golang-1.16 | no fix |
| Ubuntu Pro 22.04 LTS | golang-1.13 | no fix |
| openSUSE Leap 15.6 | go1.24 | 1.24rc2-150000.1.3.1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20250207T224745-150000.1.32.1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20250128T150132-150000.1.29.1 |
| openSUSE Tumbleweed | go1.24 | 1.24rc2-1.1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250128T150132-1.1 |