Description
Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | golang-1.15 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | golang-1.13 +1 | No fix yet | — |
| Ubuntu 18.04 LTS | golang-1.8 +2 | No fix yet | — |
| Ubuntu 16.04 LTS | golang-1.6 +1 | No fix yet | — |
| Ubuntu 14.04 LTS | golang-1.10 | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | golang-1.13 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | golang-1.16 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | golang-1.13 +1 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | golang-1.13 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | delve | 1.5.0-2.module+el8.4.0+8864+58b0fcdb | RHSA-2021:3585 |
| RHEL 8 | golang +7 | 1.15.14-2.module+el8.4.0+12542+e3fec473 | RHSA-2021:3585 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 2 | kiali | v1.24.7.redhat1-1.el8 | RHSA-2022:1276 |
| Red Hat Service Mesh 2 | servicemesh +6 | 2.0.9-3.el8 | RHSA-2022:1276 |
| Red Hat Service Mesh 2 | servicemesh-prometheus | 2.14.0-16.el8.1 | RHSA-2022:1276 |
| Red Hat Serverless 1 | openshift-serverless-clients | 0.26.0-2.el8 | RHSA-2022:0432 |
| Red Hat OpenStack 16 | etcd | 3.3.23-7.el8ost | RHSA-2022:0260, RHSA-2022:0237 |
| Red Hat OpenStack 16 | golang-github-vbatts-tar-split | 0.11.1-6.el8ost | RHSA-2022:0998, RHSA-2022:0988 |
| Red Hat OpenStack 16 | golang-qpid-apache | 0.32.0-rc1.9.el8ost | RHSA-2022:0997, RHSA-2022:0989 |
| Red Hat OpenShift 4 | butane +1 | 0.13.1-2.rhaos4.9.el8 | RHSA-2022:0557 |
| Red Hat OpenShift 4 | cri-o | 1.22.1-17.rhaos4.9.git3029b1d.el7 | RHSA-2022:0557 |
| Red Hat OpenShift 4 | cri-tools | 1.22.0-2.el8 | RHSA-2022:0557 |
| Red Hat OpenShift 4 | ignition +1 | 2.12.0-3.rhaos4.9.el8 | RHSA-2022:0557 |
| Red Hat OpenShift 4 | openshift +1 | 4.9.0-202202111950.p0.gb93fd35.assembly.stream.el7 | RHSA-2022:0557 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.9.0-202202140924.p0.g340e212.assembly.stream.el7 | RHSA-2022:0557 |
| Red Hat OpenShift 4 | prometheus-promu +1 | 0.5.0-5.git642a960.el8 | RHSA-2022:0557 |
| Red Hat Devtools 2021 | go-toolset-1.15-golang +6 | 1.15.14-2.el7_9 | RHSA-2021:3431 |
| Red Hat Container Native Virtualization 4 | kubevirt +2 | 4.8.3-251.el7 | RHSA-2021:4910 |
| Red Hat Container Native Virtualization 2 | kubevirt +2 | 2.6.8-211.el7 | RHSA-2021:4722 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | delve | 1.5.0-2.module+el8.4.0+396+d2d16ae3 | RLSA-2021:3585 |
| Rocky Linux 8 | golang +1 | 1.15.14-2.module+el8.4.0+646+fc1a61b2 | RLSA-2021:3585 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | go | 1.17-r0 | — |
| Alpine v3.23 | go | 1.17-r0 | — |
| Alpine v3.22 | go | 1.17-r0 | — |
| Alpine v3.21 | go | 1.17-r0 | — |
| Alpine v3.20 | go | 1.17-r0 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | go | 1.17-r0 | — |
| Alpine v3.18 | go | 1.17-r0 | — |
| Alpine v3.17 | go | 1.17-r0 | — |
| Alpine v3.16 | go | 1.17-r0 | — |
| Alpine v3.15 | go | 1.17-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | delve | 1.5.0-2.0.1.module+el8.4.0+20021+8a86d991 | ELSA-2021-3585 |
| Oracle Linux 8 | go-toolset | 1.15.14-2.module+el8.4.0+20307+d24cc4c6 | ELSA-2021-3585 |
| Oracle Linux 8 | golang +6 | 1.15.14-1.module+el8.4.0+20307+d24cc4c6 | ELSA-2021-3585 |
Advisories 19
- RHSA-2022:0988 Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (golang-github-vbatts-tar-split) security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2022:1276 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.9 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2022:0432 Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.20.0 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0557 Red Hat Security Advisory: OpenShift Container Platform 4.9.22 security update Red Hat Security Advisories (RHSA) · Aug 15, 2026
- RHSA-2021:3431 Red Hat Security Advisory: go-toolset-1.15-golang security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2022:0997 Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (golang-qpid-apache) security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2022:0998 Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (golang-github-vbatts-tar-split) security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2022:0989 Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (golang-qpid-apache) security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2022:0260 Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (etcd) security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2022:0237 Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (etcd) security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2021:4910 Red Hat Security Advisory: OpenShift Virtualization 4.8.3 RPMs security and bug fix update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2021:4722 Red Hat Security Advisory: OpenShift Virtualization 2.6.8 RPMs security and bug fix update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2021:3585 Red Hat Security Advisory: go-toolset:rhel8 security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RLSA-2021:3585 Moderate: go-toolset:rhel8 security update Rocky Linux Security Advisories · Feb 4, 2026
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2022-1335 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2025
- WID-SEC-2022-0941 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 18, 2024
- WID-SEC-2022-0970 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 21, 2024
- ELSA-2021-3585 Moderate: go-toolset:ol8 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 22, 2021
References
- https://golang.org/pkg/net/#ParseCIDR
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis
- https://github.com/golang/go/issues/43389
- https://github.com/golang/go/issues/30999
- https://go-review.googlesource.com/c/go/+/325829/
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.md
- FEDORA-2022-17d004ed71 vendor-advisory
- GLSA-202208-02 vendor-advisory