CVE-2021-33198: High severity IBM Security Guardium Insights vulnerability
A flaw was found in Go, where it attempts to allocate excessive memory. This issue may cause panic or unrecoverable fatal error if passed inputs with very large exponents. The highest threat from this vulnerability is to system availability.
Other sources
Go before 1.15.12 and 1.16.x before 1.16.5 attempts to allocate excessive memory (issue 2 of 2).
References: https://github.com/golang/go/issues/44910 https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
— Red Hat
Golang Go is vulnerable to a denial of service, caused by a flaw in the SetString and UnmarshalText methods of math/big.Rat. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause a panic or an unrecoverable fatal error, and results in a denial of service condition.
— IBM
In Go before 1.15.13 and 1.16.x before 1.16.5 there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.
— Microsoft
In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2021:3556
- RHSA-2021:3555
- RHSA-2021:4156
- RHSA-2022:7955
- RHSA-2022:8008
- RHSA-2021:3361
- RHSA-2022:0577
- RHSA-2021:3009
- RHBA-2021:2979
- RHSA-2021:2984
- RHSA-2021:3248
- RHSA-2021:2983
- RHSA-2021:3820
- RHSA-2021:3759
- RHSA-2021:5085
- RHSA-2021:5086
- RHSA-2021:5072
- RHSA-2021:3487
- RHSA-2021:3146
- RHSA-2022:1402
- RHSA-2022:1329
- RHSA-2022:0947
- RHSA-2021:4104
- RHSA-2022:0191
- IBM-6550866
Frequently Asked Questions
What is the vulnerability ID for this flaw in Golang Go?
The vulnerability ID is CVE-2021-33198.
What is the severity rating of CVE-2021-33198?
CVE-2021-33198 has a severity rating of high.
How does this vulnerability in Golang Go cause a denial of service?
The vulnerability in Golang Go can cause a panic or unrecoverable fatal error, resulting in a denial of service.
Is there a patch available for IBM Security Guardium Insights?
Yes, a patch is available for IBM Security Guardium Insights. You can find it at the provided URL.
How do I fix CVE-2021-33198 in Go?
To fix CVE-2021-33198 in Go, you need to update to version 1.16.5 or 1.15.13, depending on the version you are using.