CVE-2021-33194: High severity IBM Data Virtualization on Cloud Pak for Data vulnerability
A flaw was found in golang. An attacker can craft an input to ParseFragment within parse.go that would cause it to enter an infinite loop and never return. The greatest threat to the system is of availability.
Other sources
An attacker can craft an input to ParseFragment that would cause it to enter an infinite loop and never return.
References: https://github.com/golang/go/issues/46288 https://groups.google.com/g/golang-dev/c/28x0nthP-c8/m/KqWVTjsnBAAJ
— Red Hat
Go through 1.15.12 and 1.16.x through 1.16.4 has a golang.org/x/net/html infinite loop via crafted ParseFragment input.
— GitHub
Golang Go is vulnerable to a denial of service, caused by an infinite loop in golang.org/x/net/html. By sending a specially-crafted ParseFragment input, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-33194?
CVE-2021-33194 has a high severity rating due to its impact on system availability.
How do I fix CVE-2021-33194?
To fix CVE-2021-33194, upgrade to golang.org/x/net version 0.0.0-20210520170846-37e1c6afe023 or later.
Which software is affected by CVE-2021-33194?
CVE-2021-33194 affects versions of Go and golang.org/x/net up to 1.15.12 and certain versions between 1.16.0 and 1.16.4.
What type of vulnerability is CVE-2021-33194?
CVE-2021-33194 is a denial of service vulnerability due to an infinite loop in the ParseFragment function.
Can CVE-2021-33194 be exploited remotely?
Yes, CVE-2021-33194 can be exploited remotely by crafting specific inputs to the ParseFragment function.