CVE-2021-33198

In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.

In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.

The go programming language

Security Fix(es):

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.(CVE-2021-33195)

In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive s header) can cause a NewReader or OpenReader panic.(CVE-2021-33196)

In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.(CVE-2021-33197)

In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.(CVE-2021-33198)

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.(CVE-2021-34558)

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.(CVE-2021-29923)

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.(CVE-2021-38297)

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.(CVE-2021-36221)

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

The following packages have been upgraded to a later upstream version: golang (1.16.7). (BZ#1938071)

Security Fix(es):

• golang: net: lookup functions may return invalid host names (CVE-2021-33195)

• golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)

• golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)

• golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• urllib3: urllib3 does not remove the authorization HTTP header when following a cross-origin redirect (CVE-2018-25091)

• golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)

• golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

• golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)

• golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

• golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

• golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)

• golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)

• golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)

• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

• golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)

• golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. (CVE-2023-45287)

• urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803)

• ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

• moby/buildkit: Possible race condition with accessing subpaths from cache mounts (CVE-2024-23650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

The following packages have been upgraded to a later upstream version: golang (1.16.7). (BZ#1938071)

Security Fix(es):

• golang: net: lookup functions may return invalid host names (CVE-2021-33195)

• golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)

• golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)

• golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

• containers/storage: DoS via malicious image (CVE-2021-20291)
• golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

• containers/storage: DoS via malicious image (CVE-2021-20291)
• golang: net: lookup functions may return invalid host names (CVE-2021-33195)
• golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)
• golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)
• golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
• podman: possible information disclosure and modification (CVE-2022-2989)
• buildah: possible information disclosure and modification (CVE-2022-2990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)
• podman: podman machine spawns gvproxy with port bound to all IPs (CVE-2021-4024)
• Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.

Rat.SetString and Rat.UnmarshalText may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents.

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method (CVE-2021-27918).

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations (CVE-2021-31525).

A security issue has been found in Go before version 1.16.5. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in net, and their respective methods on the Resolver type may return arbitrary values retrieved from DNS which do not follow the established RFC 1035 rules for domain names. If these names are used without further sanitization, for instance unsafely included in HTML, they may allow for injection of unexpected content. Note that LookupTXT may still return arbitrary values that could require sanitization before further use (CVE-2021-33195).

A security issue has been found in Go. Due to a pre-allocation optimization in zip.NewReader, a malformed archive which indicates it has a significant number of files can cause either a panic or memory exhaustion (CVE-2021-33196).

ReverseProxy fails to delete the Connection headers (as well as other legacy hop-by-hop headers, which however per RFC 7230 need to also be specified in Connection) if there are multiple ones and the first is empty, due to an incorrect Get(h) == "" check. This can lead to a security issue if the proxy is adding an important header, like X-Forwarded-For, and is sitting in front of another proxy which can be instructed by an attacker to drop that header as a hop-by-hop header (CVE-2021-33197).

A security issue has been found in Go before version 1.16.5. The SetString and UnmarshalText methods of math/big.Rat may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198).

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic (CVE-2021-34558).

This update for go1.15 fixes the following issues:

Update to 1.15.13.

Includes these security fixes

• CVE-2021-33195: net: Lookup functions may return invalid host names (bsc#1187443).
• CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion (bsc#1186622).
• CVE-2021-33197: net/http/httputil: ReverseProxy forwards Connection headers if first one is empty (bsc#1187444)
• CVE-2021-33198: math/big: (*Rat).SetString with '1.770p02041010010011001001' crashes with 'makeslice: len out of range' (bsc#1187445).

This update was imported from the SUSE:SLE-15:Update update project.

This update for go1.16 fixes the following issues:

Update to 1.16.5.

Includes these security fixes

• CVE-2021-33195: net: Lookup functions may return invalid host names (bsc#1187443).
• CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion (bsc#1186622).
• CVE-2021-33197: net/http/httputil: ReverseProxy forwards Connection headers if first one is empty (bsc#1187444)
• CVE-2021-33198: math/big: (*Rat).SetString with '1.770p02041010010011001001' crashes with 'makeslice: len out of range' (bsc#1187445).

This update for go1.15 fixes the following issues:

Update to 1.15.13.

Includes these security fixes

• CVE-2021-33195: net: Lookup functions may return invalid host names (bsc#1187443).
• CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion (bsc#1186622).
• CVE-2021-33197: net/http/httputil: ReverseProxy forwards Connection headers if first one is empty (bsc#1187444)
• CVE-2021-33198: math/big: (*Rat).SetString with '1.770p02041010010011001001' crashes with 'makeslice: len out of range' (bsc#1187445).

These are all security issues fixed in the go1.15-1.15.15-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.16-1.16.8-1.1 package on the GA media of openSUSE Tumbleweed.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)

• podman: podman machine spawns gvproxy with port bound to all IPs (CVE-2021-4024)

• Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for go1.16 fixes the following issues:

Update to 1.16.5.

Includes these security fixes

• CVE-2021-33195: net: Lookup functions may return invalid host names (bsc#1187443).
• CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion (bsc#1186622).
• CVE-2021-33197: net/http/httputil: ReverseProxy forwards Connection headers if first one is empty (bsc#1187444)
• CVE-2021-33198: math/big: (*Rat).SetString with '1.770p02041010010011001001' crashes with 'makeslice: len out of range' (bsc#1187445).

This update for go1.15 fixes the following issues:

Update to 1.15.13.

Includes these security fixes

• CVE-2021-33195: net: Lookup functions may return invalid host names (bsc#1187443).
• CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion (bsc#1186622).
• CVE-2021-33197: net/http/httputil: ReverseProxy forwards Connection headers if first one is empty (bsc#1187444)
• CVE-2021-33198: math/big: (*Rat).SetString with '1.770p02041010010011001001' crashes with 'makeslice: len out of range' (bsc#1187445).