security: fix CVE-2023-45288

[rolandshoemaker]

This is a PRIVATE issue for CVE-2023-45288, tracked in http://b/319262343.

/cc @golang/security and @golang/release

[rolandshoemaker]

@gopherbot please open backport issues.

[gopherbot]

Backport issue(s) opened: #65387 (for 1.21), #66298 (for 1.22).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[neild]

Duplicate of #65051