Unscored RHSA-2021:3431 3 CVEs

Red Hat Security Advisory: go-toolset-1.15-golang security update

Published Sep 30, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 7

Release	Package	Fixed in
Red Hat · Devtools 2021 devtools:2021	go-toolset-1.15-golang	0:1.15.14-2.el7_9
Red Hat · Devtools 2021 devtools:2021	go-toolset-1.15-golang-bin	0:1.15.14-2.el7_9
Red Hat · Devtools 2021 devtools:2021	go-toolset-1.15-golang-docs	0:1.15.14-2.el7_9
Red Hat · Devtools 2021 devtools:2021	go-toolset-1.15-golang-misc	0:1.15.14-2.el7_9
Red Hat · Devtools 2021 devtools:2021	go-toolset-1.15-golang-race	0:1.15.14-2.el7_9
Red Hat · Devtools 2021 devtools:2021	go-toolset-1.15-golang-src	0:1.15.14-2.el7_9
Red Hat · Devtools 2021 devtools:2021	go-toolset-1.15-golang-tests	0:1.15.14-2.el7_9

Vulnerabilities 3

Unscored —

CVE-2021-29923

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in…

golang go golang-1.8 golang-1.13 Debian Ubuntu Azure Linux Alpine

Aug 7, 2021
Unscored —

CVE-2021-33195

Improper sanitization when resolving values from DNS in net

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.

golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go

Aug 2, 2021
Unscored —

CVE-2021-33197

Attacker can drop certain headers in net/http/httputil

In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.

golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go

Aug 2, 2021

References

article
https://access.redhat.com/security/updates/classification/#moderate
report
https://bugzilla.redhat.com/show_bug.cgi?id=1989564
report
https://bugzilla.redhat.com/show_bug.cgi?id=1989570
report
https://bugzilla.redhat.com/show_bug.cgi?id=1992006
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3431.json
report
https://access.redhat.com/security/cve/CVE-2021-29923
advisory
https://www.cve.org/CVERecord?id=CVE-2021-29923
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-29923
article
https://sick.codes/sick-2021-016/
report
https://access.redhat.com/security/cve/CVE-2021-33195
advisory
https://www.cve.org/CVERecord?id=CVE-2021-33195
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-33195
article
https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
report
https://access.redhat.com/security/cve/CVE-2021-33197
advisory
https://www.cve.org/CVERecord?id=CVE-2021-33197
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-33197