Published: 07/08/2021 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Go prior to 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows malicious users to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

Vulnerable Product	Search on Vulmon	Subscribe to Product
golang go
oracle timesten in-memory database
fedoraproject fedora 36

Synopsis Moderate: Red Hat OpenStack Platform 161 (golang-github-vbatts-tar-split) security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for golang-github-vbatts-tar-split is now available for Red HatO ...

Synopsis Moderate: Release of OpenShift Serverless Client kn 1200 Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Release of OpenShift Serverless Client kn 1200Red Hat Product Security has rated this update as having a ...

Synopsis Moderate: Red Hat Advanced Cluster Security 368 security and enhancement update Type/Severity Security Advisory: Moderate Topic Updated images are now available for Red Hat Advanced Cluster Security forKubernetes (RHACS) The updated image includes a bug fixes, security patches and new feature enhancementsRed Hat Product Security h ...

Synopsis Moderate: Red Hat OpenStack Platform 161 (golang-qpid-apache) security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for golang-qpid-apache is now available for Red Hat OpenStackPlatform 161 ( ...

Synopsis Moderate: Windows Container Support for Red Hat OpenShift 500 [security update] Type/Severity Security Advisory: Moderate Topic The components for Windows Container Support for Red Hat OpenShift 500 are now available This product release includes bug fixes and a moderate security update for the following packages: windows-machin ...

Synopsis Important: Red Hat OpenShift Data Foundation 4100 enhancement, security & bug fix update Type/Severity Security Advisory: Important Topic Updated images that include numerous enhancements, security, and bug fixesare now available for Red Hat OpenShift Data Foundation 4100 on Red HatEnterprise Linux 8Red Hat Product Security ...

Synopsis Moderate: Red Hat OpenStack Platform 162 (golang-qpid-apache) security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for golang-qpid-apache is now available for Red Hat OpenStackPlatform 162 ( ...

Synopsis Moderate: Red Hat OpenStack Platform 162 (golang-github-vbatts-tar-split) security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for golang-github-vbatts-tar-split is now available for Red HatO ...

Synopsis Important: Red Hat OpenShift Service Mesh 209 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Service Mesh 209Red Hat Product Security has rated this update as having a secu ...

Synopsis Moderate: OpenShift Container Platform 4922 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4922 is now available withupdates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security impactof M ...

Synopsis Moderate: OpenShift Container Platform 4922 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Container Platform release 4922 is now available withupdates to packages and images ...

Synopsis Moderate: Release of OpenShift Serverless 1200 Type/Severity Security Advisory: Moderate Topic Release of OpenShift Serverless 1200Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available fo ...

Synopsis Moderate: Red Hat OpenShift distributed tracing 210 security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat Openshit distributed tracing 21Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, ...

Synopsis Moderate: OpenShift Virtualization 4100 Images security and bug fix update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Virtualization release 4100 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a securit ...

Go before 117 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation This affects netParseIP and netParseCIDR ...

Detect if your kubernetes cluster is using "funny" IPv4 addresses

Funny IPs detector for Kubernetes clusters Since golang 117, IPv4 addresses with leading zeros are rejected by the standard library The rationale behind this decision is perfectly explained by Russ cox @rsc in this comment: We are treating the change as a robustness improvement and not a security fix due to its potential for breaking working use cases The situation is not n

NVD-CWE-noinfo https://github.com/golang/go/issues/43389 https://github.com/golang/go/issues/30999 https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.md https://golang.org/pkg/net/#ParseCIDR https://go-review.googlesource.com/c/go/+/325829/https://www.oracle.com/security-alerts/cpujan2022.html https://security.gentoo.org/glsa/202208-02 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/https://nvd.nist.gov https://github.com/aojea/funny-ip-etcd-detector https://access.redhat.com/errata/RHSA-2022:0988

Get Started

CVE-2021-29923

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect