Vulnerability Description
Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Golang | Go | < 1.17 |
| Oracle | Timesten In-Memory Database | < 21.1.1.1.0 |
| Fedoraproject | Fedora | 36 |
References
- https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudisThird Party Advisory
- https://github.com/golang/go/issues/30999ExploitIssue TrackingThird Party Advisory
- https://github.com/golang/go/issues/43389Issue TrackingThird Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.mdExploitThird Party Advisory
- https://go-review.googlesource.com/c/go/+/325829/PatchThird Party Advisory
- https://golang.org/pkg/net/#ParseCIDRVendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202208-02Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatchThird Party Advisory
- https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudisThird Party Advisory
- https://github.com/golang/go/issues/30999ExploitIssue TrackingThird Party Advisory
- https://github.com/golang/go/issues/43389Issue TrackingThird Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.mdExploitThird Party Advisory
- https://go-review.googlesource.com/c/go/+/325829/PatchThird Party Advisory
- https://golang.org/pkg/net/#ParseCIDRVendor Advisory
FAQ
What is CVE-2021-29923?
CVE-2021-29923 is a vulnerability with a CVSS score of 7.5 (HIGH). Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP a...
How severe is CVE-2021-29923?
CVE-2021-29923 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-29923?
Check the references section above for vendor advisories and patch information. Affected products include: Golang Go, Oracle Timesten In-Memory Database, Fedoraproject Fedora.