CVE-2021-38297

Katalog CVE

CVSS 9.8 · Critical EPSS 10,9%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada golang go, fedoraproject fedora. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

Rincian

Terbit di NVD

18 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

10,9% peluang dieksploitasi; lebih tinggi dari 95,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://groups.google.com/g/golang-announce/c/AEBu9j7yj5A mailing list · release notes · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-02 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20211118-0006/ advisory pihak ketiga
• https://groups.google.com/forum/#%21forum/golang-announce
• https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24S...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5...