PT-2021-14861 · Elastic · Apm Agent For Go

Rob Liebowitz · Published 2021-02-10 · Updated 2021-05-18 · CVE-2021-22133

Positive Technologies (AI Summary)

CVSS v2.0

2.7

Low

Base vector

AV:A/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elastic APM agent for Go versions prior to 1.11.0

Description The issue arises when the application panics, potentially leading to the leakage of sensitive HTTP header information. Normally, the APM agent sanitizes sensitive HTTP header details before sending them to the APM server. However, during an application panic, it is possible that these headers will not be sanitized before being sent.

Recommendations For Elastic APM agent for Go versions prior to 1.11.0, update to version 1.11.0 or later to resolve the issue. As a temporary workaround, consider implementing additional logging sanitization measures to minimize the risk of sensitive HTTP header information leakage during application panics.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2021-22133

GHSA-QQC5-RGCC-CJQH

GO-2022-0706

Affected Products

Apm Agent For Go

References · 12

• https://osv.dev/vulnerability/GO-2022-0706 · Vendor Advisory
• https://discuss.elastic.co/t/elastic-apm-agent-for-go-1-11-0-security-update/263252 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22133 · Security Note
• https://osv.dev/vulnerability/GHSA-qqc5-rgcc-cjqh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22133 · Vendor Advisory
• https://github.com/elastic/apm-agent-go · Note
• https://github.com/elastic/apm-agent-go/commit/c5c7e21aa26a6def7790f74fbceed792ad47ef35 · Note
• https://github.com/elastic/apm-agent-go/compare/v1.10.0...v1.11.0 · Note
• https://github.com/elastic/apm-agent-go/pull/888 · Note
• https://github.com/elastic/apm-agent-go/commit/dd3e8c593580e7b80a98b57e1cc6e017e56747b4 · Note
• https://t.me/cibsecurity/23390 · Telegram Post
• https://pkg.go.dev/vuln/GO-2022-0706 · Note