CVE-2021-29923

Name
CVE-2021-29923
Description
Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.
NVD Severity
medium
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/golang/go/issues/43389
MISC https://github.com/golang/go/issues/30999
MISC https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis
MISC https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.md
MISC https://golang.org/pkg/net/#ParseCIDR
MISC https://go-review.googlesource.com/c/go/+/325829/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* go >= None < 1.17

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
go 3.14-community 1.16.10-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable