CVEvulnerability
CVE-2021-29923
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-08-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Description
Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.
Affected configurations
• golang go (< 1.17)
• oracle timesten in-memory database (< 21.1.1.1.0)
• fedoraproject fedora 36
Related
Referenced by CWE · observed example (1)
- CWE-1389 Incorrect Parsing of Numbers with Different Radices weakness
References
- https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis Third Party Advisory
- https://github.com/golang/go/issues/30999 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/golang/go/issues/43389 Issue Tracking, Third Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.md Exploit, Third Party Advisory
- https://go-review.googlesource.com/c/go/+/325829/ Patch, Third Party Advisory
- https://golang.org/pkg/net/#ParseCIDR Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202208-02 Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
- https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis Third Party Advisory
- https://github.com/golang/go/issues/30999 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/golang/go/issues/43389 Issue Tracking, Third Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.md Exploit, Third Party Advisory
- https://go-review.googlesource.com/c/go/+/325829/ Patch, Third Party Advisory
- https://golang.org/pkg/net/#ParseCIDR Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202208-02 Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory