Unrated
Security advisory
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-23773
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 14:03 UTC · Revision 1
Source evidence
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
osv:CVE-2022-23773
Complete source record
{
"id": "1cae84e3b72e962bec332047a651541fcebc0c2d8c6f43ffa5ddd2f93af4791f",
"url": "https://osv.dev/vulnerability/CVE-2022-23773",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2022-23773",
"summary": "cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.",
"evidence": "osv:CVE-2022-23773",
"products": [],
"severity": "unknown",
"structured": {
"id": "CVE-2022-23773",
"aliases": [
"BIT-golang-2022-23773",
"CVE-2022-23773",
"GO-2022-0318"
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/golang/go",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "0a6cf8706fdd0fe1bd26e4d1ecbcd41650bf5e6c"
},
{
"fixed": "6a70ee2873b2367e2a0d6e7d7e167c072b99daf0"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.16.14"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.17.0"
},
{
"fixed": "1.17.7"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"go1.17.6",
"go1.16.13",
"go1.17.5",
"go1.16.12",
"go1.17.4",
"go1.16.11",
"go1.16.10",
"go1.17.3",
"go1.16.9",
"go1.17.2",
"go1.16.8",
"go1.17.1",
"go1.17",
"go1.17rc2",
"go1.16.7",
"go1.16.6",
"go1.17rc1",
"go1.16.5",
"go1.17beta1",
"go1.16.4",
"go1.16.3",
"go1.16.2",
"go1.16",
"go1.16rc1",
"go1.16beta1",
"go1.15beta1",
"go1.14beta1",
"go1.13beta1",
"go1.12beta2",
"go1.12beta1",
"go1.11beta3",
"go1.11beta2",
"go1.11beta1",
"go1.10rc2",
"go1.10rc1",
"go1.10beta2",
"go1.10beta1",
"go1.9beta2",
"go1.9beta1",
"go1.8beta2",
"go1.8beta1",
"go1.7rc4",
"go1.7rc3",
"go1.7rc2",
"go1.7rc1",
"go1.7beta2",
"go1.7beta1",
"go1.6beta2",
"go1.6beta1",
"go1.5beta3",
"go1.5beta2",
"go1.5beta1",
"go1.4beta1",
"go1.3beta2",
"go1.3beta1",
"weekly.2012-03-27",
"weekly",
"weekly.2012-03-22",
"weekly.2012-03-13",
"weekly.2012-03-04",
"weekly.2012-02-22",
"weekly.2012-02-14",
"weekly.2012-02-07",
"weekly.2012-01-27",
"weekly.2012-01-20",
"weekly.2012-01-15",
"weekly.2011-12-22",
"weekly.2011-12-14",
"weekly.2011-12-06",
"weekly.2011-12-02",
"weekly.2011-12-01",
"weekly.2011-11-18",
"weekly.2011-11-09",
"weekly.2011-11-08",
"weekly.2011-11-02",
"weekly.2011-11-01",
"weekly.2011-10-26",
"weekly.2011-10-25",
"weekly.2011-10-18",
"weekly.2011-10-06",
"weekly.2011-09-21",
"weekly.2011-09-16",
"weekly.2011-08-17",
"weekly.2011-09-07",
"weekly.2011-09-01",
"weekly.2011-08-10",
"weekly.2011-07-07",
"weekly.2011-07-29",
"weekly.2011-07-19",
"weekly.2011-06-09",
"weekly.2011-06-23",
"weekly.2011-06-16",
"weekly.2011-06-02",
"weekly.2011-05-22",
"weekly.2011-04-27",
"weekly.2011-04-13",
"weekly.2011-04-04",
"weekly.2011-03-28",
"weekly.2011-03-15",
"weekly.2011-03-07.1",
"release.r56",
"weekly.2011-03-07",
"weekly.2011-02-24",
"weekly.2011-02-15",
"weekly.2011-02-01.1",
"weekly.2011-02-01",
"weekly.2011-01-20",
"weekly.2011-01-19",
"weekly.2011-01-12",
"weekly.2011-01-06",
"weekly.2010-12-22",
"weekly.2010-12-15.1",
"weekly.2010-12-15",
"weekly.2010-12-08",
"weekly.2010-12-02",
"weekly.2010-11-23",
"weekly.2010-11-10",
"weekly.2010-11-02",
"weekly.2010-10-27",
"weekly.2010-10-20",
"weekly.2010-10-13.1",
"weekly.2010-10-13",
"weekly.2010-09-29",
"weekly.2010-09-22",
"weekly.2010-09-15",
"weekly.2010-09-06",
"weekly.2010-08-25",
"weekly.2010-08-11",
"weekly.2010-08-04",
"weekly.2010-07-29",
"weekly.2010-07-14",
"weekly.2010-07-01",
"weekly.2010-06-21",
"weekly.2010-06-09",
"weekly.2010-05-27",
"weekly.2010-05-04",
"weekly.2010-04-27",
"weekly.2010-04-13",
"weekly.2010-03-30",
"weekly.2010-03-22",
"weekly.2010-03-15",
"weekly.2010-03-04",
"weekly.2010-02-23",
"weekly.2010-02-17",
"weekly.2010-02-04",
"weekly.2010-01-27",
"weekly.2010-01-13",
"weekly.2010-01-05",
"weekly.2009-12-22",
"weekly.2009-12-09",
"weekly.2009-12-07",
"weekly.2009-11-17",
"weekly.2009-11-12",
"weekly.2009-11-10.1",
"weekly.2009-11-10",
"weekly.2009-11-06"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23773.json"
}
}
],
"modified": "2026-10-28T02:30:35.847779480Z",
"provider": "osv",
"references": [
"https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ",
"https://www.oracle.com/security-alerts/cpujul2022.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23773.json",
"https://nvd.nist.gov/vuln/detail/CVE-2022-23773",
"https://security.gentoo.org/glsa/202208-02",
"https://security.netapp.com/advisory/ntap-20220225-0006/"
],
"provider_metadata": {
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23773.json"
}
},
"related_cves": [
{
"value": "CVE-2022-23773",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 503425,
"published_at": "2022-02-11T00:16:08+00:00"
}