title: Command 'go get' may unexpectedly fallback to insecure git in cmd/go
description: Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
problem types: CWE-636: Not Failing Securely ('Failing Open')
affected:
{
vendor: Go toolchain
product: cmd/go
collectionURL: https://pkg.go.dev
packageName: cmd/go
versions:
version: 0, lessThan: 1.20.12, status: affected, versionType: semver
version: 1.21.0-0, lessThan: 1.21.5, status: affected, versionType: semver
defaultStatus: unaffected
}