Skip to content
OpenAdvisories
Unscored RHSA-2021:4156 4 CVEs

Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update

Published Oct 21, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream delve 0:1.6.0-1.module+el8.5.0+10379+d6b83bd0
Red Hat · RHEL 8 enterprise_linux:8::appstream delve-debuginfo 0:1.6.0-1.module+el8.5.0+10379+d6b83bd0
Red Hat · RHEL 8 enterprise_linux:8::appstream delve-debugsource 0:1.6.0-1.module+el8.5.0+10379+d6b83bd0
Red Hat · RHEL 8 enterprise_linux:8::appstream go-toolset 0:1.16.7-1.module+el8.5.0+12246+1aac4e3f
Red Hat · RHEL 8 enterprise_linux:8::appstream golang 0:1.16.7-1.module+el8.5.0+12246+1aac4e3f
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-bin 0:1.16.7-1.module+el8.5.0+12246+1aac4e3f
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-docs 0:1.16.7-1.module+el8.5.0+12246+1aac4e3f
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-misc 0:1.16.7-1.module+el8.5.0+12246+1aac4e3f
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-race 0:1.16.7-1.module+el8.5.0+12246+1aac4e3f
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-src 0:1.16.7-1.module+el8.5.0+12246+1aac4e3f
Red Hat · RHEL 8 enterprise_linux:8::appstream golang-tests 0:1.16.7-1.module+el8.5.0+12246+1aac4e3f

Vulnerabilities 4

  • Unscored —
    CVE-2021-33195

    Improper sanitization when resolving values from DNS in net

    Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-33197

    Attacker can drop certain headers in net/http/httputil

    In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-33198

    Panic on inputs with large exponents in math/big

    In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.

    go stdlib golang-1.8 golang-1.16 Debian Ubuntu Alpine Go
  • Unscored —
    CVE-2021-36221

    Panic in ReverseProxy in net/http/httputil

    Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

    go stdlib golang-1.8 golang-1.13 Debian Ubuntu Alpine Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1972825
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1976168
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1979100
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1989564
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1989570
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1989575
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1995656
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4156.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-33195
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-33195
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-33195
  • article
    https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
  • report
    https://access.redhat.com/security/cve/CVE-2021-33197
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-33197
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-33197
  • report
    https://access.redhat.com/security/cve/CVE-2021-33198
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-33198
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-33198
  • report
    https://access.redhat.com/security/cve/CVE-2021-36221
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-36221
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-36221
  • article
    https://groups.google.com/g/golang-announce/c/uHACNfXAZqk