PT-2021-6618 · Go+5 · Go+5

Published 2021-07-08 · Updated 2024-03-06 · CVE-2021-29923

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.17

Description The issue is related to the incorrect handling of extraneous zero characters at the beginning of an IP address octet, allowing attackers to bypass access control based on IP addresses due to unexpected octal interpretation. This affects the net.ParseIP and net.ParseCIDR functions.

Recommendations For versions prior to 1.17, update to version 1.17 or later to resolve the issue. As a temporary workaround, consider restricting the use of the net.ParseIP and net.ParseCIDR functions until a patch is available.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2021-2786

ALT-PU-2022-1707

ALT-PU-2023-1205

AZL-79056

BDU:2022-01896

BIT-GOLANG-2021-29923

CESA-2021_3585

CVE-2021-29923

OESA-2021-1402

RHSA-2021:3431

RHSA-2021:3585

RHSA-2021:4722

RHSA-2021:4910

RHSA-2021_3585

RHSA-2022:0237

RHSA-2022:0260

RHSA-2022:0432

RHSA-2022:0557

RHSA-2022:0988

RHSA-2022:0989

RHSA-2022:0997

RHSA-2022:0998

RHSA-2022:1276

RLSA-2021:3585

Affected Products

Alt Linux

Centos

Debian

Go

Red Hat

Rocky Linux

References · 38

• 🔥 https://github.com/golang/go/issues/30999 · Exploit
• 🔥 https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.md · Exploit
• https://linux.oracle.com/errata/ELSA-2021-3585.html · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:3585 · Vendor Advisory
• https://go-review.googlesource.com/c/go/+/325829 · Patch
• https://security.gentoo.org/glsa/202208-02 · Vendor Advisory
• https://golang.org/pkg/net/#ParseCIDR · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33196 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-33197 · Security Note
• https://osv.dev/vulnerability/BIT-golang-2021-29923 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38297 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-29923 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://errata.rockylinux.org/RLSA-2021:3585 · Vendor Advisory