Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-29923

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

Published

2021-08-07T17:15:07.067

Last Modified

2024-11-21T06:01:59.570

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	golang	go	< 1.17	Yes
Application	oracle	timesten_in-memory_database	< 21.1.1.1.0	Yes
Operating System	fedoraproject	fedora	36	Yes

References

https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis Third Party Advisory ([email protected])
https://github.com/golang/go/issues/30999 Exploit, Issue Tracking, Third Party Advisory ([email protected])
https://github.com/golang/go/issues/43389 Issue Tracking, Third Party Advisory ([email protected])
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.md Exploit, Third Party Advisory ([email protected])
https://go-review.googlesource.com/c/go/+/325829/ Patch, Third Party Advisory ([email protected])
https://golang.org/pkg/net/#ParseCIDR Vendor Advisory ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/ ([email protected])
https://security.gentoo.org/glsa/202208-02 Third Party Advisory ([email protected])
https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory ([email protected])
https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/golang/go/issues/30999 Exploit, Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/golang/go/issues/43389 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.md Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://go-review.googlesource.com/c/go/+/325829/ Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://golang.org/pkg/net/#ParseCIDR Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/ (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/202208-02 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)