CVE-2021-33195: XSS
A flaw was found in Go. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in the net package and methods on the Resolver type, may return arbitrary values retrieved from DNS, allowing injection of unexpected contents. The highest threat from this vulnerability is to integrity.
Other sources
Go before 1.15.12 and 1.16.x before 1.16.5 allows injection.
References: https://github.com/golang/go/issues/46241 https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
— Red Hat
Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.
Golang Go could allow a remote attacker to execute arbitrary code on the system, caused by not following RFC 1035 rules in the LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in net. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2021:3556
- RHSA-2021:3555
- RHSA-2021:3431
- RHSA-2021:4156
- RHSA-2021:4226
- RHSA-2022:8008
- RHSA-2021:3361
- RHSA-2022:0577
- RHSA-2021:3009
- RHBA-2021:2979
- RHSA-2021:2984
- RHSA-2021:3248
- RHSA-2021:2983
- RHSA-2021:3820
- RHSA-2021:3759
- RHSA-2021:5085
- RHSA-2021:5086
- RHSA-2021:5072
- RHSA-2021:3487
- RHSA-2021:3146
- RHSA-2022:1402
- RHSA-2022:1329
- RHSA-2022:0947
- RHSA-2021:4104
- RHSA-2022:0191
- IBM-6550866
Frequently Asked Questions
What is CVE-2021-33195?
CVE-2021-33195 is a vulnerability in Go before 1.15.13 and 1.16.x before 1.16.5 that could allow a remote attacker to execute arbitrary code on the system.
What is the severity of CVE-2021-33195?
CVE-2021-33195 has a severity rating of 7.5 (High).
Which functions in Go are affected by CVE-2021-33195?
The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in net are affected by CVE-2021-33195.
How can I fix CVE-2021-33195?
You can fix CVE-2021-33195 by updating to Go version 1.15.13 or 1.16.5.
Where can I find more information about CVE-2021-33195?
You can find more information about CVE-2021-33195 in the following references: [link1](https://github.com/golang/go/issues/46241), [link2](https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI), [link3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1989568).