CVE-2024-45340

GOAUTH credential leak in cmd/go

State: Published
Severity: 8.8 High
Published: Jan 28, 2025
Updated: Jan 30, 2025
Reserved: Aug 27, 2024

Description

Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
cmd/goGo toolchain	1.24.0-0 to before 1.24.0-rc.2Affected

References

https://go.dev/cl/643097
https://go.dev/issue/71249
https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ
https://pkg.go.dev/vuln/GO-2025-3383

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.