CVE-2021-29923

HIGH severity · CVSS 7.5

7.5CVSS HIGH

Summary

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactNone

Integrity impactHigh

Availability impactNone

Exploit probability (EPSS)0%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products we track (1)

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: https://go-review.googlesource.com/c/go/+/325829/ ↗

Additional information

NVD record
https://go-review.googlesource.com/c/go/+/325829/Patch
https://golang.org/pkg/net/#ParseCIDRAdvisory
https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudisAdvisory
https://github.com/golang/go/issues/43389Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/
https://security.gentoo.org/glsa/202208-02Advisory
https://github.com/golang/go/issues/30999Advisory
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.mdAdvisory