{"id":"CVE-2021-33197","aliases":["ALPINE-CVE-2021-33197","ALSA-2021:4156","ALSA-2021:4226","ALSA-2022:7954","ALSA-2022:8008","AZL-79094","AZL-98925","BELL-CVE-2021-33197","BIT-golang-2021-33197","DEBIAN-CVE-2021-33197","EUVD-2021-19910","GHSA-wqr7-cf9q-rvf7","GO-2021-0241","MGASA-2021-0369","OESA-2021-1402","RHBA-2021:2979","RHSA-2021:2984","RHSA-2021:3009","RHSA-2021:3248","RHSA-2021:3431","RHSA-2021:3487","RHSA-2021:3555","RHSA-2021:3820","RHSA-2021:4156","RHSA-2021:4226","RHSA-2021:5072","RHSA-2021:5085","RHSA-2022:1329","RHSA-2022:1402","RHSA-2022:7954","RHSA-2022:8008","RLSA-2021:4156","RLSA-2021:4226","SUSE-SU-2021:2186-1","SUSE-SU-2021:2214-1","UBUNTU-CVE-2021-33197","openSUSE-SU-2021:0950-1","openSUSE-SU-2021:2186-1","openSUSE-SU-2021:2214-1","openSUSE-SU-2024:10808-1","openSUSE-SU-2024:10809-1"],"status":"published","title":"Go before 1.15.12 and 1.16.x before 1.16.5 acts as an Unintended Proxy or Intermediary.","description":"In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0226,"percentile":0.83107,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2021-06-28T16:23:28Z","modified":"2026-11-03T06:32:34Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"go","fixed_in":["1.15.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"go","fixed_in":["1.16.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"go","fixed_in":["1.16.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"go","fixed_in":["1.16.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"go","fixed_in":["1.16.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"go","fixed_in":["1.16.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"go","fixed_in":["1.16.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"go","fixed_in":["1.16.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"go","fixed_in":["1.16.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"go","fixed_in":["1.16.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"go","fixed_in":["1.16.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.16.5-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.15.13","1.16.5"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"golang-1.15","fixed_in":["1.15.9-5"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.15.13","1.16.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.15.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.5-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-1.module_el8.5.0+2604+960c7771"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.9-4.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.0-2.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.0-2.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.25.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.13"},{"introduced":"1.16.0"},{"fixed":"1.16.5"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"golang-1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.9-5"}]}]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.13"},{"introduced":"1.16.0-0"},{"fixed":"1.16.5"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.14-1.mga8"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-5.oe1"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-5.oe1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-4.rhaos4.7.git1d56dc8.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"ignition-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-4.rhaos4.7.git1d56dc8.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"ignition-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-4.rhaos4.7.git1d56dc8.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"ignition-validate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-4.rhaos4.7.git1d56dc8.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"ignition-validate-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-4.rhaos4.7.git1d56dc8.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.4-7.rhaos4.7.git6287500.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.4-7.rhaos4.7.git6287500.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.558d959.assembly.stream.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.558d959.assembly.stream.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"atomic-openshift-service-idler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107291238.p0.git.39cfc66.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.4-7.rhaos4.7.git6287500.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.4-7.rhaos4.7.git6287500.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.4-7.rhaos4.7.git6287500.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.558d959.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.558d959.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"redhat-release-coreos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:47.84-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-8.rhaos4.8.git8d4264e.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-8.rhaos4.8.git8d4264e.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107292313.p0.git.1077b05.assembly.stream.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107292313.p0.git.1077b05.assembly.stream.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-8.rhaos4.8.git8d4264e.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-8.rhaos4.8.git8d4264e.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-8.rhaos4.8.git8d4264e.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-7.rhaos4.8.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"ignition-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-7.rhaos4.8.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"ignition-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-7.rhaos4.8.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"ignition-validate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-7.rhaos4.8.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"ignition-validate-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-7.rhaos4.8.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107292313.p0.git.1077b05.assembly.stream.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107292313.p0.git.1077b05.assembly.stream.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-8.rhaos4.6.git947598e.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"ignition-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-8.rhaos4.6.git947598e.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"ignition-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-8.rhaos4.6.git947598e.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"ignition-validate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-8.rhaos4.6.git947598e.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"ignition-validate-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-8.rhaos4.6.git947598e.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.6-3.rhaos4.6.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"containernetworking-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.6-3.rhaos4.6.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-4.git642a960.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-4.git642a960.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.15-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-2.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.15-golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-2.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.15-golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-2.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.15-golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-2.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.15-golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-2.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.15-golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-2.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.15-golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-2.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-3.1.el8ost.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"etcd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-3.1.el8ost.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"etcd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-3.1.el8ost.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:serverless:1.0::el8","package":"openshift-serverless-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.23.2-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.289.3.1633554819-1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"butane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.1-2.rhaos4.8.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"butane-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.1-2.rhaos4.8.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0-1.module+el8.5.0+10379+d6b83bd0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0-1.module+el8.5.0+10379+d6b83bd0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0-1.module+el8.5.0+10379+d6b83bd0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.7-1.module+el8.5.0+12246+1aac4e3f"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.7-1.module+el8.5.0+12246+1aac4e3f"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.7-1.module+el8.5.0+12246+1aac4e3f"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.7-1.module+el8.5.0+12246+1aac4e3f"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.7-1.module+el8.5.0+12246+1aac4e3f"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.7-1.module+el8.5.0+12246+1aac4e3f"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.7-1.module+el8.5.0+12246+1aac4e3f"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.7-1.module+el8.5.0+12246+1aac4e3f"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.9-4.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.9-4.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-3.1.el8ost.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"etcd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-3.1.el8ost.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"etcd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-3.1.el8ost.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift_data_foundation:4.9::el8","package":"mcg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.9.0-28.61dcf87.5.9.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.8::el7","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.5-278.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.8::el7","package":"kubevirt-virtctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.5-278.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.8::el7","package":"kubevirt-virtctl-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.5-278.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.8::el8","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.5-278.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.8::el8","package":"kubevirt-virtctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.5-278.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.8::el8","package":"kubevirt-virtctl-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.5-278.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:2.6::el7","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.10-230.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:2.6::el7","package":"kubevirt-virtctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.10-230.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:2.6::el7","package":"kubevirt-virtctl-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.10-230.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:2.6::el8","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.10-230.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:2.6::el8","package":"kubevirt-virtctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.10-230.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:2.6::el8","package":"kubevirt-virtctl-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.10-230.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-catatonit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.0-3.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.0-2.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.0-2.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.0-2.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.0-2.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.0-2.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0-1.module+el8.5.0+694+f77f0bfd"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.7-1.module+el8.5.0+694+f77f0bfd"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.7-1.module+el8.5.0+694+f77f0bfd"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.9-4.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.5-1.17.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.5-1.17.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.13-1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.13-1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.13-1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.13-1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.13-1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.13-1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.13-1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.13-1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.13-1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.13-1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.13-1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~18.04.2","1.16.2-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~20.04","1.16.2-0ubuntu1~20.04.1","1.16.2-0ubuntu1~20.04.1+esm1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.13-lp152.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.5-1.17.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.13-1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.15-1.2"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.8-1.1"}]}],"bundled":10}],"products":[{"vendor":"golang","product":"go"}],"references":[{"url":"https://groups.google.com/g/golang-announce","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","advisory","fix","web","article","report"]},{"url":"https://security.gentoo.org/glsa/202208-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33197","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wqr7-cf9q-rvf7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-33197","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-33195","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-33197","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-33198","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-36221","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-27358","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-3114","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-34558","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2022:7954","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28851","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28852","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-20199","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-20291","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33197","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-34558","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4024","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-27191","tags":["report"]},{"url":"https://bugzilla.redhat.com/1913333","tags":["report"]},{"url":"https://bugzilla.redhat.com/1913338","tags":["report"]},{"url":"https://bugzilla.redhat.com/1919050","tags":["report"]},{"url":"https://bugzilla.redhat.com/1939485","tags":["report"]},{"url":"https://bugzilla.redhat.com/1983596","tags":["report"]},{"url":"https://bugzilla.redhat.com/1989570","tags":["report"]},{"url":"https://bugzilla.redhat.com/2026675","tags":["report"]},{"url":"https://bugzilla.redhat.com/2064702","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-7954.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8008","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33195","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33198","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2989","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2990","tags":["report"]},{"url":"https://bugzilla.redhat.com/1989564","tags":["report"]},{"url":"https://bugzilla.redhat.com/1989575","tags":["report"]},{"url":"https://bugzilla.redhat.com/2121445","tags":["report"]},{"url":"https://bugzilla.redhat.com/2121453","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-8008.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-33197","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-33197","tags":["advisory"]},{"url":"https://go.dev/cl/321929","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/950fa11c4cb01a145bb07eeb167d90a1846061b3","tags":["fix"]},{"url":"https://go.dev/issue/46313","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2021-0369.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29037","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EXHOWUQKHNS4LEJ2GTYWY2EEAYVCKECW/","tags":["web","advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4PG5AXR4LXEWYU5DHYEVESCXWKO3HFHO/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/QLUQXBCOPWP72ZSS3SM3CTURM7XOYALQ/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AKQH4LHYIFOWBEGMGHD7S7TTV7JL4U7W/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OZJXXUXBI66VV2PXRNAWN4MCE3AOHNBA/","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1402","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33196","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34558","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29923","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36221","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2021:2979","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988937","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhba-2021_2979.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-31525","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958341","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-31525","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31525","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989564","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33195","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33197","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989575","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33198","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1983596","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-34558","tags":["advisory"]},{"url":"https://golang.org/doc/devel/release#go1.15.minor","tags":["article"]},{"url":"https://golang.org/doc/devel/release#go1.16.minor","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2984","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1965503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988945","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2984.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33196","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33196","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3009","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989867","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3009.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3248","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1996683","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1996707","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3248.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3431","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992006","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3431.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-29923","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-29923","tags":["advisory"]},{"url":"https://sick.codes/sick-2021-016/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3487","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3487.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3555","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1983656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992955","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3555.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3703","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3703","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3703","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-27918","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937901","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-27918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27918","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3820","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013510","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3820.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21670","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21670","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21670","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2278","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21671","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21671","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21671","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2371","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4156","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1972825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1976168","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979100","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995656","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4156.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-36221","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-36221","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/uHACNfXAZqk","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4226","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1918750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941024","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4226.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3114","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3114","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/mperVMGa98w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-27358","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-27358","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27358","tags":["advisory"]},{"url":"https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:5072","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5072.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:5085","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1886638","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1996033","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998680","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5085.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8565","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8565","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8565","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes/issues/95623","tags":["article"]},{"url":"https://groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1329","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044050","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1329.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1402","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051113","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1402.json","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1913333","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1913338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1939485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1972303","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026675","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064702","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081349","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2088116","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2092798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2097694","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7954.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28851","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28851","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28852","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28852","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4024","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4024","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20199","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20291","tags":["advisory"]},{"url":"https://unit42.paloaltonetworks.com/cve-2021-20291/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-27191","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27191","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/-cp44ypCT5s/m/wmegxkLiAQAJ","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081835","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121445","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121453","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8008.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2989","tags":["advisory"]},{"url":"https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2990","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4156","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4226","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212186-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182345","tags":["report"]},{"url":"https://bugzilla.suse.com/1186622","tags":["report"]},{"url":"https://bugzilla.suse.com/1187443","tags":["report"]},{"url":"https://bugzilla.suse.com/1187444","tags":["report"]},{"url":"https://bugzilla.suse.com/1187445","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33198","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212214-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1175132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-33197","tags":["report"]},{"url":"https://github.com/golang/go/issues/46313","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SGO7YQOALHD4E75OV7S4WAPP2UR3AXKT/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UUQZOWPTQG2RZGQ367S6AID56JYVM5T6/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39293","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-33197","description":"In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.","status":"published","published":"2021-08-02T18:54:45Z","modified":"2024-08-03T23:42:20.296Z","updated_at":"2026-11-02T14:33:10.204494Z"}],"euvd":[{"id":"EUVD-2021-19910","description":"In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.","status":"published","published":"2021-08-02T18:54:45Z","modified":"2024-08-03T23:42:20Z","updated_at":"2026-11-03T03:24:34.73748Z"}],"ghsa":[{"id":"GHSA-wqr7-cf9q-rvf7","title":"Go before 1.15.12 and 1.16.x before 1.16.5 acts as an Unintended Proxy or Intermediary.","description":"Go before 1.15.12 and 1.16.x before 1.16.5 acts as an Unintended Proxy or Intermediary.","status":"published","published":"2022-05-24T19:09:31Z","modified":"2023-01-27T05:04:18Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:42:25.677567Z"}],"nvd":[{"id":"CVE-2021-33197","description":"In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.","status":"published","published":"2021-08-02T19:15:08.493Z","modified":"2026-06-17T03:54:20.44Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:06:56.562207Z"}],"osv":[{"id":"ALPINE-CVE-2021-33197","description":"In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.","status":"published","published":"2021-08-02T19:15:08.493Z","modified":"2026-11-03T06:32:34.190874619Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"AZL-79094","title":"CVE-2021-33197 affecting package golang 1.25.7-1","description":"In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.","status":"published","published":"2021-08-02T19:15:08Z","modified":"2026-04-21T04:34:38.088038Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"AZL-98925","title":"CVE-2021-33197 affecting package golang 1.27.1-1","description":"In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.","status":"published","published":"2021-08-02T19:15:08Z","modified":"2026-09-16T06:39:01Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BELL-CVE-2021-33197","title":"CVE-2021-33197 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:04.70026Z","modified":"2026-01-26T09:45:59.055228Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-33197","description":"In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.","status":"published","published":"2021-08-02T19:15:08.493Z","modified":"2026-10-24T10:30:31.999459337Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"DEBIAN-CVE-2021-33197","description":"In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.","status":"published","published":"2021-08-02T19:15:08.493Z","modified":"2026-08-27T23:04:03.316812948Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2021-1402","title":"golang security update","description":"The go programming language\r\n\r\nSecurity Fix(es):\r\n\r\nGo before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.(CVE-2021-33195)\n\nIn archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive s header) can cause a NewReader or OpenReader panic.(CVE-2021-33196)\n\nIn Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.(CVE-2021-33197)\n\nIn Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.(CVE-2021-33198)\n\nThe crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.(CVE-2021-34558)\n\nGo before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.(CVE-2021-29923)\n\nGo before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.(CVE-2021-38297)\n\nGo before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.(CVE-2021-36221)","status":"published","published":"2021-10-27T11:04:40Z","modified":"2026-08-18T01:16:06.608548299Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHBA-2021:2979","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 4.7.23 packages update","status":"published","published":"2024-09-29T18:29:41Z","modified":"2026-08-05T10:08:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2021:2984","title":"Red Hat Security Advisory: OpenShift Container Platform 4.8.4 bug fix and security update","status":"published","published":"2024-09-30T14:17:59Z","modified":"2026-08-05T10:09:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3009","title":"Red Hat Security Advisory: OpenShift Container Platform 4.6.42 security update","status":"published","published":"2024-09-29T18:29:20Z","modified":"2026-08-05T10:09:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3248","title":"Red Hat Security Advisory: OpenShift Container Platform 4.8.9 packages and security update","status":"published","published":"2024-09-29T18:29:55Z","modified":"2026-08-05T10:09:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3431","title":"Red Hat Security Advisory: go-toolset-1.15-golang security update","status":"published","published":"2024-09-30T14:18:26Z","modified":"2026-08-05T10:09:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3487","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (etcd) security update","status":"published","published":"2024-09-29T18:30:09Z","modified":"2026-08-05T10:09:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3555","title":"Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.17.0","status":"published","published":"2024-09-30T14:18:38Z","modified":"2026-08-05T10:09:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3820","title":"Red Hat Security Advisory: OpenShift Container Platform 4.8.15 packages and security update","status":"published","published":"2024-09-29T18:29:45Z","modified":"2026-08-05T10:09:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:4156","title":"Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update","status":"published","published":"2024-10-21T18:02:02Z","modified":"2026-08-05T10:09:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:4226","title":"Red Hat Security Advisory: grafana security, bug fix, and enhancement update","status":"published","published":"2024-09-29T18:30:07Z","modified":"2026-08-08T10:01:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:5072","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (etcd) security update","status":"published","published":"2024-09-29T18:30:13Z","modified":"2026-08-05T10:09:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2021:5085","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.9.0 enhancement, security, and bug fix update","status":"published","published":"2024-09-29T18:30:20Z","modified":"2026-08-05T10:09:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:1329","title":"Red Hat Security Advisory: OpenShift Virtualization 4.8.5 RPMs security update","status":"published","published":"2024-09-29T18:30:58Z","modified":"2026-08-05T10:10:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:1402","title":"Red Hat Security Advisory: OpenShift Virtualization 2.6.10 RPMs security and bug fix update","status":"published","published":"2024-09-29T18:31:06Z","modified":"2026-08-05T10:10:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:7954","title":"Red Hat Security Advisory: podman security and bug fix update","status":"published","published":"2024-09-30T14:28:34Z","modified":"2026-10-17T10:01:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8008","title":"Red Hat Security Advisory: buildah security and bug fix update","status":"published","published":"2024-09-30T14:28:42Z","modified":"2026-10-09T10:05:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2021:4156","title":"Moderate: go-toolset:rhel8 security, bug fix, and enhancement update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nThe following packages have been upgraded to a later upstream version: golang (1.16.7). (BZ#1938071)\n\nSecurity Fix(es):\n\n* golang: net: lookup functions may return invalid host names (CVE-2021-33195)\n\n* golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)\n\n* golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)\n\n* golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:25:49Z","modified":"2026-02-04T11:15:11.249218Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:4226","title":"Moderate: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nThe following packages have been upgraded to a later upstream version: grafana (7.5.9). (BZ#1921191)\n\nSecurity Fix(es):\n\n* golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)\n\n* grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call (CVE-2021-27358)\n\n* golang: net: lookup functions may return invalid host names (CVE-2021-33195)\n\n* golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)\n\n* golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:46:47Z","modified":"2026-02-05T08:15:12.635566Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-33197","description":"In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.","status":"published","published":"2021-08-02T19:15:00Z","modified":"2025-10-24T04:50:22Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"ALSA-2021:4156","title":"Moderate: go-toolset:rhel8 security, bug fix, and enhancement update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nThe following packages have been upgraded to a later upstream version: golang (1.16.7). (BZ#1938071)\n\nSecurity Fix(es):\n\n* golang: net: lookup functions may return invalid host names (CVE-2021-33195)\n\n* golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)\n\n* golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)\n\n* golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:25:49Z","modified":"2026-10-29T11:00:34.190476029Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:4226","title":"Moderate: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nThe following packages have been upgraded to a later upstream version: grafana (7.5.9). (BZ#1921191)\n\nSecurity Fix(es):\n\n* golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)\n\n* grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call (CVE-2021-27358)\n\n* golang: net: lookup functions may return invalid host names (CVE-2021-33195)\n\n* golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)\n\n* golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:46:47Z","modified":"2026-10-29T11:01:09.798224032Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2022:7954","title":"Moderate: podman security and bug fix update","description":"The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.\n\nSecurity Fix(es):\n\n* golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851)\n* golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852)\n* podman: podman machine spawns gvproxy with port bound to all IPs (CVE-2021-4024)\n* podman: Remote traffic to rootless containers is seen as orginating from localhost (CVE-2021-20199)\n* containers/storage: DoS via malicious image (CVE-2021-20291)\n* golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)\n* golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)\n* golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-11-15T00:00:00Z","modified":"2026-10-29T11:31:17.390295247Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2022:8008","title":"Moderate: buildah security and bug fix update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. \n\nSecurity Fix(es):\n\n* containers/storage: DoS via malicious image (CVE-2021-20291)\n* golang: net: lookup functions may return invalid host names (CVE-2021-33195)\n* golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)\n* golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)\n* golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)\n* podman: possible information disclosure and modification (CVE-2022-2989)\n* buildah: possible information disclosure and modification (CVE-2022-2990)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-11-15T00:00:00Z","modified":"2026-10-29T11:31:19.985703498Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"BIT-golang-2021-33197","description":"In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.","status":"published","published":"2024-03-06T11:04:55.405Z","modified":"2026-09-08T08:47:48.166802743Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"GO-2021-0241","title":"Attacker can drop certain headers in net/http/httputil","description":"ReverseProxy can be made to forward certain hop-by-hop headers, including Connection. If the target of the ReverseProxy is itself a reverse proxy, this lets an attacker drop arbitrary headers, including those set by the ReverseProxy.Director.","status":"published","published":"2022-02-17T17:33:16Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2021-0369","title":"Updated golang packages fix security vulnerabilities","description":"encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop\nif a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of\nan element. This can occur in the Decode, DecodeElement, or Skip method\n(CVE-2021-27918).\n\nnet/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers\nto cause a denial of service (panic) via a large header to ReadRequest or\nReadResponse. Server, Transport, and Client can each be affected in some\nconfigurations (CVE-2021-31525).\n\nA security issue has been found in Go before version 1.16.5. The LookupCNAME,\nLookupSRV, LookupMX, LookupNS, and LookupAddr functions in net, and their\nrespective methods on the Resolver type may return arbitrary values retrieved\nfrom DNS which do not follow the established RFC 1035 rules for domain names.\nIf these names are used without further sanitization, for instance unsafely\nincluded in HTML, they may allow for injection of unexpected content. Note\nthat LookupTXT may still return arbitrary values that could require\nsanitization before further use (CVE-2021-33195).\n\nA security issue has been found in Go. Due to a pre-allocation optimization in\nzip.NewReader, a malformed archive which indicates it has a significant number\nof files can cause either a panic or memory exhaustion (CVE-2021-33196).\n\nReverseProxy fails to delete the Connection headers (as well as other legacy\nhop-by-hop headers, which however per RFC 7230 need to also be specified in\nConnection) if there are multiple ones and the first is empty, due to an\nincorrect Get(h) == \"\" check. This can lead to a security issue if the proxy\nis adding an important header, like X-Forwarded-For, and is sitting in front\nof another proxy which can be instructed by an attacker to drop that header as\na hop-by-hop header (CVE-2021-33197).\n\nA security issue has been found in Go before version 1.16.5. The SetString and\nUnmarshalText methods of math/big.Rat may cause a panic or an unrecoverable\nfatal error if passed inputs with very large exponents (CVE-2021-33198).\n\nThe crypto/tls package of Go through 1.16.5 does not properly assert that the\ntype of public key in an X.509 certificate matches the expected type when\ndoing a RSA based key exchange, allowing a malicious TLS server to cause a TLS\nclient to panic (CVE-2021-34558).\n","status":"published","published":"2021-07-25T08:34:17Z","modified":"2026-04-16T04:41:34.082310587Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0950-1","title":"Security update for go1.15","description":"This update for go1.15 fixes the following issues:\n\nUpdate to 1.15.13.\n    \nIncludes these security fixes \n\n- CVE-2021-33195: net: Lookup functions may return invalid host names (bsc#1187443).\n- CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion (bsc#1186622).\n- CVE-2021-33197: net/http/httputil: ReverseProxy forwards Connection headers if first one is empty (bsc#1187444)\n- CVE-2021-33198: math/big: (*Rat).SetString with '1.770p02041010010011001001' crashes with 'makeslice: len out of range' (bsc#1187445).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-07-01T12:30:43Z","modified":"2026-02-04T02:18:05.896662Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:2186-1","title":"Security update for go1.16","description":"This update for go1.16 fixes the following issues:\n\nUpdate to 1.16.5.\n\nIncludes these security fixes \n\n- CVE-2021-33195: net: Lookup functions may return invalid host names (bsc#1187443).\n- CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion (bsc#1186622).\n- CVE-2021-33197: net/http/httputil: ReverseProxy forwards Connection headers if first one is empty (bsc#1187444)\n- CVE-2021-33198: math/big: (*Rat).SetString with '1.770p02041010010011001001' crashes with 'makeslice: len out of range' (bsc#1187445).\n","status":"published","published":"2021-06-28T16:23:29Z","modified":"2026-02-04T02:29:55.913952Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2214-1","title":"Security update for go1.15","description":"This update for go1.15 fixes the following issues:\n\nUpdate to 1.15.13.\n    \nIncludes these security fixes \n\n- CVE-2021-33195: net: Lookup functions may return invalid host names (bsc#1187443).\n- CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion (bsc#1186622).\n- CVE-2021-33197: net/http/httputil: ReverseProxy forwards Connection headers if first one is empty (bsc#1187444)\n- CVE-2021-33198: math/big: (*Rat).SetString with '1.770p02041010010011001001' crashes with 'makeslice: len out of range' (bsc#1187445).\n","status":"published","published":"2021-06-30T13:59:41Z","modified":"2026-02-04T02:36:35.563933Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:10808-1","title":"go1.15-1.15.15-1.2 on GA media","description":"These are all security issues fixed in the go1.15-1.15.15-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:46:55.765323Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10809-1","title":"go1.16-1.16.8-1.1 on GA media","description":"These are all security issues fixed in the go1.16-1.16.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:16:42.475775Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:2186-1","title":"Security update for go1.16","description":"This update for go1.16 fixes the following issues:\n\nUpdate to 1.16.5.\n\nIncludes these security fixes \n\n- CVE-2021-33195: net: Lookup functions may return invalid host names (bsc#1187443).\n- CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion (bsc#1186622).\n- CVE-2021-33197: net/http/httputil: ReverseProxy forwards Connection headers if first one is empty (bsc#1187444)\n- CVE-2021-33198: math/big: (*Rat).SetString with '1.770p02041010010011001001' crashes with 'makeslice: len out of range' (bsc#1187445).\n","status":"published","published":"2021-06-28T16:23:28Z","modified":"2026-02-04T04:18:13.968166Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2214-1","title":"Security update for go1.15","description":"This update for go1.15 fixes the following issues:\n\nUpdate to 1.15.13.\n    \nIncludes these security fixes \n\n- CVE-2021-33195: net: Lookup functions may return invalid host names (bsc#1187443).\n- CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion (bsc#1186622).\n- CVE-2021-33197: net/http/httputil: ReverseProxy forwards Connection headers if first one is empty (bsc#1187444)\n- CVE-2021-33198: math/big: (*Rat).SetString with '1.770p02041010010011001001' crashes with 'makeslice: len out of range' (bsc#1187445).\n","status":"published","published":"2021-06-30T13:59:58Z","modified":"2026-02-04T04:10:33.38747Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}