PT-2021-6523 · Google+7 · Go+7
Haya Shulman
+1
·
Published
2021-02-19
·
Updated
2024-06-15
·
CVE-2021-33195
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Go versions 1.15.x before 1.15.13
Go versions 1.16.x before 1.16.5
Description
The issue is related to the DNS lookup functions in the Go programming language, which do not properly validate replies from DNS servers. This can lead to the return of unsafe injections, such as XSS, that do not conform to the RFC1035 format. The vulnerability allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The affected functions include LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr, which may return arbitrary values retrieved from DNS that do not follow established rules for domain names. If these names are used without further sanitization, they may allow for injection of unexpected content.
Recommendations
For Go versions 1.15.x before 1.15.13, update to version 1.15.13 or later to resolve the issue.
For Go versions 1.16.x before 1.16.5, update to version 1.16.5 or later to resolve the issue.
As a temporary workaround, consider sanitizing the output of the LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions to prevent injection of unexpected content.
Exploit
Fix
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Go
Red Hat
Rocky Linux
Suse