CVE-2021-29923: Input Validation
A flaw was found in golang. Extraneous zero characters at the beginning of an IP address octet are not properly considered which could allow an attacker to bypass IP-based access controls. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.
Golang Go could allow a remote attacker to bypass security restrictions, caused by improper consideration for extraneous zero characters at the beginning of an IP address octet. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass access control based on IP addresses.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2022:0434
- RHSA-2022:0432
- RHSA-2022:1276
- RHSA-2021:3431
- RHSA-2021:3585
- RHSA-2022:0577
- RHSA-2022:0557
- RHSA-2022:0561
- RHSA-2022:1372
- RHSA-2022:0318
- RHSA-2022:0260
- RHSA-2022:0988
- RHSA-2022:0989
- RHSA-2022:0237
- RHSA-2022:0997
- RHSA-2022:0998
- RHSA-2021:4902
- RHSA-2022:0431
- RHSA-2021:4722
- RHSA-2021:4910
- RHSA-2021:4725
- RHSA-2022:0947
- IBM-6550866
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-29923.
What is the severity level of CVE-2021-29923?
CVE-2021-29923 has a severity level of high.
How does CVE-2021-29923 bypass access control?
CVE-2021-29923 bypasses access control based on IP by improperly considering extraneous zero characters at the beginning of an IP address octet.
Which software versions are affected by CVE-2021-29923?
Versions up to 1.17.0 of Go, 0:0.26.0-2.el8 of openshift-serverless-clients, 0:v1.24.7.redhat1-1.el8 of kiali, 0:2.0.9-3.el8 of servicemesh, 0:2.14.0-16.el8.1 of servicemesh-prometheus, 0:2.0.9-3.el8 of servicemesh-proxy, 1.15-golang-0:1.15.14-2.el7_9 of go-toolset, 0:0.13.1-2.rhaos4.9.el8 of butane, 0:1.22.1-17.rhaos4.9.git3029b1d.el7 of cri-o, 0:1.22.0-2.el8 of cri-tools, 0:0.5.0-5.git642a960.el8 of golang-github-prometheus-promu, 0:2.12.0-3.rhaos4.9.el8 of ignition, 0:3.3.23-7.el8 of etcd, 0:0.11.1-6.el8 of golang-github-vbatts-tar-split, 0:0.32.0-rc1.9.el8 of golang-qpid-apache, 0:2.6.8-211.el7 and 0:4.8.3-251.el7 of kubevirt, 0:2.6.8-211.el8 and 0:4.8.3-251.el8 of kubevirt, and versions up to 21.1.1.1.0 of Oracle TimesTen In-Memory Database are affected by CVE-2021-29923.
How can I fix CVE-2021-29923?
To fix CVE-2021-29923, update to version 1.17.0 or newer of Go, or apply the recommended patches for the affected software.