CVE-2021-33195

Опубликовано: 02 авг. 2021

Источник: nvd

CVSS3: 7.3

CVSS2: 7.5

EPSS Низкий

Описание

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.

Ссылки

https://groups.google.com/g/golang-announce
Third Party Advisory
https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
Exploit
Patch
Third Party Advisory
https://security.gentoo.org/glsa/202208-02
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210902-0005/
Third Party Advisory
https://groups.google.com/g/golang-announce
Third Party Advisory
https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
Exploit
Patch
Third Party Advisory
https://security.gentoo.org/glsa/202208-02
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210902-0005/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

Версия до 1.15.13 (исключая)

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

Версия от 1.16.0 (включая) до 1.16.5 (исключая)

Конфигурация 2

cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:*

EPSS

Процентиль: 7%

0.00029

Низкий

7.3 High

CVSS3

7.5 High

CVSS2

Дефекты

CWE-74

Связанные уязвимости

CVE-2021-33195

CVSS3: 7.3

ubuntu

почти 4 года назад

CVE-2021-33195

CVSS3: 7.5

redhat

около 4 лет назад

CVE-2021-33195

CVSS3: 7.3

msrc

9 месяцев назад

Описание отсутствует

CVE-2021-33195

CVSS3: 7.3

debian

почти 4 года назад

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS looku ...

GHSA-xf7m-5vgf-jhv9

CVSS3: 7.3

github

около 3 лет назад

Go before 1.15.12 and 1.16.x before 1.16.5 allows injection.

EPSS

Процентиль: 7%

0.00029

Низкий

7.3 High

CVSS3

7.5 High

CVSS2

Дефекты

CWE-74