ALT-PU-2021-2786-1
Closed vulnerabilities
Published: 2021-07-08
BDU:2022-01896
Уязвимость компонентов net.ParseIP, net.ParseCIDR языка программирования Go, позволяющая нарушителю оказать воздействие на целостность данных
Severity: HIGH (7.5)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References:
Published: 2021-08-07
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2021-29923
Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References:
- https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis
- https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis
- https://github.com/golang/go/issues/30999
- https://github.com/golang/go/issues/30999
- https://github.com/golang/go/issues/43389
- https://github.com/golang/go/issues/43389
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.md
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.md
- https://golang.org/pkg/net/#ParseCIDR
- https://golang.org/pkg/net/#ParseCIDR
- https://go-review.googlesource.com/c/go/+/325829/
- https://go-review.googlesource.com/c/go/+/325829/
- FEDORA-2022-17d004ed71
- FEDORA-2022-17d004ed71
- GLSA-202208-02
- GLSA-202208-02
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
Published: 2022-01-24
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2021-39293
In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
- https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
- https://groups.google.com/g/golang-announce/c/dx9d7IOseHw
- https://groups.google.com/g/golang-announce/c/dx9d7IOseHw
- [debian-lts-announce] 20230419 [SECURITY] [DLA 3395-1] golang-1.11 security update
- [debian-lts-announce] 20230419 [SECURITY] [DLA 3395-1] golang-1.11 security update
- https://security.netapp.com/advisory/ntap-20220217-0009/
- https://security.netapp.com/advisory/ntap-20220217-0009/