5.3
CVSSv3

CVE-2021-33197

Published: 02/08/2021 Updated: 14/09/2022
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 5.3 | Impact Score: 1.4 | Exploitability Score: 3.9
VMScore: 384
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Summary

In Go prior to 1.15.13 and 1.16.x prior to 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

golang go

Vendor Advisories

Debian Bug report logs - #989492 golang-116: CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion Package: src:golang-116; Maintainer for src:golang-116 is Go Compiler Team <team+go-compiler@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 5 Jun 2 ...
Synopsis Moderate: OpenShift Virtualization 2610 RPMs security and bug fix update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Virtualization release 2610 is now available with updates to packages ...
Synopsis Moderate: OpenShift Virtualization 485 RPMs security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Virtualization release 485 is now available with updates to packages and images tha ...
Synopsis Moderate: podman security and bug fix update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for podman is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as h ...
Synopsis Moderate: Windows Container Support for Red Hat OpenShift 500 [security update] Type/Severity Security Advisory: Moderate Topic The components for Windows Container Support for Red Hat OpenShift 500 are now available This product release includes bug fixes and a moderate security update for the following packages: windows-machin ...
Synopsis Moderate: buildah security and bug fix update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for buildah is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as ...
Synopsis Moderate: OpenShift Virtualization 4100 Images security and bug fix update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Virtualization release 4100 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a securit ...
A flaw was found in Go, acting as an unintended proxy or intermediary, where ReverseProxy forwards connection headers if the first one was empty This flaw allows an attacker to drop arbitrary headers The highest threat from this vulnerability is to integrity (CVE-2021-33197) A flaw was found in Go, where it attempts to allocate excessive memory ...
A null pointer dereference vulnerability was found in golang When using the library's ssh server without specifying an option for GSSAPIWithMICConfig, it is possible for an attacker to craft an ssh client connection using the authentication method and cause the server to panic resulting in a denial of service The highest threat from this vulnera ...
A security issue has been found in Go before version 1165 ReverseProxy in net/http/httputil could be made to forward certain hop-by-hop headers, including Connection In case the target of the ReverseProxy was itself a reverse proxy, this would let an attacker drop arbitrary headers, including those set by the ReverseProxyDirector ...