{"id":"CVE-2021-41771","aliases":["ALPINE-CVE-2021-41771","ALSA-2022:1819","AZL-6451","AZL-79102","AZL-98868","BELL-CVE-2021-41771","BIT-golang-2021-41771","DEBIAN-CVE-2021-41771","DLA-2891-1","DLA-2892-1","DLA-3395-1","EUVD-2021-28779","GHSA-g56w-5r6h-483w","GO-2021-0263","MGASA-2021-0537","OESA-2021-1443","RHSA-2022:1745","RHSA-2022:1819","RLSA-2022:1819","SUSE-SU-2021:3833-1","SUSE-SU-2021:3834-1","UBUNTU-CVE-2021-41771","openSUSE-SU-2021:1539-1","openSUSE-SU-2021:3833-1","openSUSE-SU-2021:3834-1","openSUSE-SU-2024:11609-1","openSUSE-SU-2024:11610-1"],"status":"published","title":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17...","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.04698,"percentile":0.91878,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2021-11-08T00:00:00Z","modified":"2026-11-05T11:45:15Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"go","fixed_in":["1.16.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"golang","fixed_in":["1.17.8-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.16.10","1.17.3"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"golang-1.15","fixed_in":["1.15.15-1~deb11u2"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.16.10","1.17.3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"golang","fixed_in":["1.15.7-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"golang","fixed_in":["1.15.7-6.oe1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.16.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.8-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.26.10-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.10"},{"introduced":"1.17.0"},{"fixed":"1.17.3"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"golang-1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.15-1~deb11u2"}]}],"versions":["1.15.15-1~deb11u1","1.15.9-6"]},{"source":"osv","ecosystem":"Debian:9","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1+deb9u4"}]}],"versions":["1.8.1-1","1.8.1-1+deb9u1","1.8.1-1+deb9u2","1.8.1-1+deb9u3"],"bundled":6},{"source":"osv","ecosystem":"Debian:9","package":"golang-1.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-2+deb9u4"}]}],"versions":["1.7.4-2","1.7.4-2+deb9u1","1.7.4-2+deb9u2","1.7.4-2+deb9u3"],"bundled":6},{"source":"osv","ecosystem":"Debian:10","package":"golang-1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.6-1+deb10u6"}]}],"versions":["1.11.6-1","1.11.6-1+deb10u1","1.11.6-1+deb10u2","1.11.6-1+deb10u3","1.11.6-1+deb10u4","1.11.6-1+deb10u5"],"bundled":10},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.10"},{"introduced":"1.17.0-0"},{"fixed":"1.17.3"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-6.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:serverless:1.0::el8","package":"openshift-serverless-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.module+el8.6.0+12972+ebab5911"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.module+el8.6.0+12972+ebab5911"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.module+el8.6.0+12972+ebab5911"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.module+el8.6.0+824+8e984c20"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+824+8e984c20"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+824+8e984c20"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-1.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-1.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.10-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.10-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~18.04.2","1.16.2-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~20.04","1.16.2-0ubuntu1~20.04.1","1.16.2-0ubuntu1~20.04.1+esm1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.10-lp152.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-1.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.10-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.10-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-1.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"golang","product":"go"}],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/0fM21h43arc","tags":["x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://security.netapp.com/advisory/ntap-20211210-0003/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202208-02","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","tags":["x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41771","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/"},{"url":"https://github.com/advisories/GHSA-g56w-5r6h-483w"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-41771","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-1819.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-38297","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-39293","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-41771","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-41772","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-23772","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-23773","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-23806","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-41771","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-41771","tags":["advisory"]},{"url":"https://go.dev/cl/367075","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/61536ec03063b4951163bd09609c86d82631fa27","tags":["fix"]},{"url":"https://go.dev/issue/48990","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2021-0537.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29717","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-December/009791.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DRORBGLIRSYNYTIE3EARJHAXYB2X5YQ3/","tags":["web","advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1443","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1745","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020736","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1745.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41771","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41771","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41772","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1819","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2006044","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2012887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014704","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053429","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053541","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1819.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-38297","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38297","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/AEBu9j7yj5A","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-39293","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39293","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39293","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/dx9d7IOseHw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23772","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23773","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23773","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23773","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23806","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23806","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23806","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1819","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213833-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190649","tags":["report"]},{"url":"https://bugzilla.suse.com/1192377","tags":["report"]},{"url":"https://bugzilla.suse.com/1192378","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41772","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213834-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41771","tags":["report"]},{"url":"https://github.com/golang/go/issues/48990","tags":["report"]},{"url":"https://github.com/golang/go/commit/4a842985bf3f71d93a2b1340d9d6685bebc12b6b","tags":["report"]},{"url":"https://github.com/golang/go/commit/d19c5bdb24e093a2d5097b7623284eb02726cede","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PLB2XVI2D26YAVC7GRXSA47KJWR52UCR/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WHZ4EPZFI4C6TOOTOETZZVUOYMZB3YGR/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-41771","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.","status":"published","published":"2021-11-08T00:00:00Z","modified":"2024-08-04T03:15:29.252Z","updated_at":"2026-11-02T14:32:59.105382Z"}],"euvd":[{"id":"EUVD-2021-28779","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.","status":"published","published":"2021-11-08T00:00:00Z","modified":"2024-08-04T03:15:29Z","updated_at":"2026-11-03T03:24:17.230256Z"}],"ghsa":[{"id":"GHSA-g56w-5r6h-483w","title":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17...","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.","status":"published","published":"2022-05-24T19:20:03Z","modified":"2023-04-20T00:30:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:54:32.269335Z"}],"nvd":[{"id":"CVE-2021-41771","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.","status":"published","published":"2021-11-08T06:15:08.057Z","modified":"2026-06-17T04:08:53.673Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:07:00.984108Z"}],"osv":[{"id":"ALPINE-CVE-2021-41771","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.","status":"published","published":"2021-11-08T06:15:08.057Z","modified":"2026-11-03T06:31:47.276049953Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"AZL-6451","title":"CVE-2021-41771 affecting package golang for versions less than 1.17.8-1","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.","status":"published","published":"2021-11-08T06:15:08Z","modified":"2026-04-21T04:32:25.845835Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"AZL-79102","title":"CVE-2021-41771 affecting package golang 1.26.10-1","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.","status":"published","published":"2021-11-08T06:15:08Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"AZL-98868","title":"CVE-2021-41771 affecting package golang 1.27.1-1","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.","status":"published","published":"2021-11-08T06:15:08Z","modified":"2026-09-16T06:39:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BELL-CVE-2021-41771","title":"CVE-2021-41771 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:23.501Z","modified":"2026-01-26T10:04:51.332931Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-41771","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.","status":"published","published":"2021-11-08T06:15:08.057Z","modified":"2026-10-24T10:30:50.373752246Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"DEBIAN-CVE-2021-41771","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.","status":"published","published":"2021-11-08T06:15:08.057Z","modified":"2026-08-27T23:01:53.478715094Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"OESA-2021-1443","title":"golang security update","description":"The Go Programming Language.\r\n\r\nSecurity Fix(es):\r\n\r\nImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.(CVE-2021-41771)","status":"published","published":"2021-11-26T11:04:42Z","modified":"2026-08-18T01:16:09.493390723Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2022:1745","title":"Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.22.0","status":"published","published":"2024-09-18T04:47:35Z","modified":"2026-10-13T10:03:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:1819","title":"Red Hat Security Advisory: go-toolset:rhel8 security and bug fix update","status":"published","published":"2024-10-21T18:05:15Z","modified":"2026-10-16T10:01:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:1819","title":"Moderate: go-toolset:rhel8 security and bug fix update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang: Command-line arguments may overwrite global data (CVE-2021-38297)\n\n* golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196) (CVE-2021-39293)\n\n* golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)\n\n* golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)\n\n* golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772)\n\n* golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)\n\n* golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:29:31Z","modified":"2026-02-05T15:15:08.338595Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-41771","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.","status":"published","published":"2021-11-08T06:15:00Z","modified":"2026-11-05T11:45:15.485083024Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T13:30:49.23793Z"},{"id":"ALSA-2022:1819","title":"Moderate: go-toolset:rhel8 security and bug fix update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang: Command-line arguments may overwrite global data (CVE-2021-38297)\n\n* golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196) (CVE-2021-39293)\n\n* golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)\n\n* golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)\n\n* golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772)\n\n* golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)\n\n* golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:29:31Z","modified":"2026-10-29T11:01:15.87334149Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-golang-2021-41771","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.","status":"published","published":"2024-03-06T11:03:51.776Z","modified":"2026-10-16T09:45:16.359913436Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"DLA-2891-1","title":"golang-1.8 - security update","status":"published","published":"2022-01-21T00:00:00Z","modified":"2026-03-09T01:20:28.60547Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-2892-1","title":"golang-1.7 - security update","status":"published","published":"2022-01-21T00:00:00Z","modified":"2026-03-09T01:23:01.364917Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3395-1","title":"golang-1.11 - security update","status":"published","published":"2023-04-19T00:00:00Z","modified":"2026-03-09T01:20:27.682779Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"GO-2021-0263","title":"Panic on invalid symbol tables in debug/macho","description":"Calling File.ImportedSymbols on a loaded file which contains an invalid dynamic symbol table command can cause a panic, in particular if the encoded number of undefined symbols is larger than the number of symbols in the symbol table.","status":"published","published":"2022-01-13T03:45:03Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2021-0537","title":"Updated golang packages fix security vulnerability","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10\nand 1.17.x before 1.17.3 Accesses a Memory Location After the End of a\nBuffer, aka an out-of-bounds slice situation. (CVE-2021-41771)\n  \n\nGo before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip\nReader.Open panic via a crafted ZIP archive containing an invalid name or\nan empty filename field. (CVE-2021-41772)\n","status":"published","published":"2021-12-03T18:45:31Z","modified":"2026-04-16T04:44:27.218359249Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1539-1","title":"Security update for go1.16","description":"This update for go1.16 fixes the following issues:\n\nSecurity update go1.16.10 (released 2021-11-04) (bsc#1182345).\n\n- CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).\n- CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-12-06T13:06:42Z","modified":"2026-02-04T02:16:41.567066Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3833-1","title":"Security update for go1.17","description":"This update for go1.17 fixes the following issues:\n\nSecurity update go1.17.3 (released 2021-11-04) (bsc#1190649).\n\n- CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).\n- CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).\n","status":"published","published":"2021-12-01T15:04:58Z","modified":"2026-02-04T04:06:56.067426Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3834-1","title":"Security update for go1.16","description":"This update for go1.16 fixes the following issues:\n\nSecurity update go1.16.10 (released 2021-11-04) (bsc#1182345).\n\n- CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).\n- CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).\n","status":"published","published":"2021-12-01T15:05:22Z","modified":"2026-02-04T03:59:40.997879Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11609-1","title":"go1.16-1.16.10-1.1 on GA media","description":"These are all security issues fixed in the go1.16-1.16.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:14.81693Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11610-1","title":"go1.17-1.17.3-1.1 on GA media","description":"These are all security issues fixed in the go1.17-1.17.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:15:31.559447Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:3833-1","title":"Security update for go1.17","description":"This update for go1.17 fixes the following issues:\n\nSecurity update go1.17.3 (released 2021-11-04) (bsc#1190649).\n\n- CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).\n- CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).\n","status":"published","published":"2021-12-01T15:04:57Z","modified":"2026-02-04T03:07:17.493402Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3834-1","title":"Security update for go1.16","description":"This update for go1.16 fixes the following issues:\n\nSecurity update go1.16.10 (released 2021-11-04) (bsc#1182345).\n\n- CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).\n- CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).\n","status":"published","published":"2021-12-01T15:05:21Z","modified":"2026-02-04T02:54:43.601825Z","updated_at":"2026-11-02T15:53:49.605187Z"}]}}