Description
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
Exploits (3)
References (4)
Scores
CVSS v3
7.5
EPSS
0.0012
EPSS Percentile
30.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-436
Status
published
Products (5)
golang/go
< 1.16.14
netapp/beegfs_csi_driver
netapp/cloud_insights_telegraf_agent
netapp/kubernetes_monitoring_operator
netapp/storagegrid
Published
Feb 11, 2022
Tracked Since
Feb 18, 2026