CVE-2021-29923

Katalog CVE

CVSS 7.5 · High EPSS 3,7%

Kerentanan pada golang go, oracle timesten in-memory database +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

Rincian

Terbit di NVD

7 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

EPSS (30 hari)

3,7% peluang dieksploitasi; lebih tinggi dari 89,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://golang.org/pkg/net/#ParseCIDR advisory vendor
• https://go-review.googlesource.com/c/go/+/325829/ patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis advisory pihak ketiga
• https://github.com/golang/go/issues/30999 exploit · issue tracking · advisory pihak ketiga
• https://github.com/golang/go/issues/43389 issue tracking · advisory pihak ketiga
• https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.md exploit · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-02 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBC...