CVE-2021-29923

Name
CVE-2021-29923
Description
Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/golang/go/issues/43389
MISC https://github.com/golang/go/issues/30999
MISC https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis
MISC https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.md
MISC https://golang.org/pkg/net/#ParseCIDR
MISC https://go-review.googlesource.com/c/go/+/325829/
Patch https://www.oracle.com/security-alerts/cpujan2022.html
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* go >= None < 1.17

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
go 3.14-community 1.16.10-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable