CVE-2021-33197: Input Validation
A flaw was found in Go, acting as an unintended proxy or intermediary, where ReverseProxy forwards connection headers if the first one was empty. This flaw allows an attacker to drop arbitrary headers. The highest threat from this vulnerability is to integrity.
Other sources
Go before 1.15.12 and 1.16.x before 1.16.5 acts as an Unintended Proxy or Intermediary.
References: https://github.com/golang/go/issues/46313 https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
— Red Hat
Golang Go could allow a remote attacker to bypass security restrictions, caused by a flaw in the ReverseProxy in net/http/httputil. By sending a specially-crafted request, an attacker could exploit this vulnerability to drop arbitrary headers, including those set by the ReverseProxy.Director.
— IBM
In Go before 1.15.13 and 1.16.x before 1.16.5 some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
— Microsoft
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2021:3556
- RHSA-2021:3555
- RHSA-2021:3431
- RHSA-2021:4156
- RHSA-2021:4226
- RHSA-2022:7954
- RHSA-2022:8008
- RHSA-2021:3361
- RHSA-2022:0577
- RHSA-2021:3009
- RHBA-2021:2979
- RHSA-2021:2984
- RHSA-2021:3248
- RHSA-2021:2983
- RHSA-2021:3820
- RHSA-2021:3759
- RHSA-2021:5085
- RHSA-2021:5086
- RHSA-2021:5072
- RHSA-2021:3487
- RHSA-2021:3146
- RHSA-2022:1402
- RHSA-2022:1329
- RHSA-2022:0947
- RHSA-2021:4104
- RHSA-2022:0191
- IBM-6550866
Frequently Asked Questions
What is CVE-2021-33197?
CVE-2021-33197 is a vulnerability in Go that allows a remote attacker to bypass security restrictions.
How does CVE-2021-33197 affect Golang Go?
CVE-2021-33197 affects Golang Go versions before 1.15.13 and 1.16.x before 1.16.5.
What is the severity of CVE-2021-33197?
CVE-2021-33197 has a severity rating of 7.5 (high).
How can an attacker exploit CVE-2021-33197?
An attacker can exploit CVE-2021-33197 by sending a specially-crafted request to drop arbitrary headers.
What is the remedy for CVE-2021-33197?
To fix CVE-2021-33197, update your Golang Go installation to version 1.15.13 or 1.16.5.