Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golang-binUpgrade golangUpgrade golang-testsUpgrade golang-srcUpgrade golang-raceUpgrade golang-miscUpgrade golang-docsUpgrade go-toolset | May 4, 2022 | Aug 7, 2021 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 7, 2021 |
| Centos_linux | — | Upgrade delveUpgrade golang-raceUpgrade golangUpgrade golang-miscUpgrade go-toolsetUpgrade golang-docsUpgrade golang-testsUpgrade delve-debugsourceUpgrade golang-binUpgrade golang-srcUpgrade delve-debuginfo | Sep 22, 2021 | Aug 7, 2021 |
| Debian | — | No solution exists | May 15, 2025 | Aug 7, 2021 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 7, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golangUpgrade golang-binUpgrade golang-src | Nov 12, 2021 | Aug 7, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-binUpgrade golang-srcUpgrade golang | Nov 2, 2021 | Aug 7, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jan 28, 2022 | Aug 7, 2021 |
| Oracle_linux | — | Upgrade golang-testsUpgrade golang-binUpgrade golangUpgrade golang-docsUpgrade golang-raceUpgrade golang-miscUpgrade golang-srcUpgrade delveUpgrade go-toolset | Sep 23, 2021 | Mar 22, 2021 |
| Redhat Openshift | — | Upgrade windows-machine-config-rhel8-operatorUpgrade cri-oUpgrade butaneUpgrade cri-toolsUpgrade ignitionUpgrade golang-github-prometheus-promu | Feb 24, 2022 | Mar 22, 2021 |
| Redhat_linux | — | Upgrade golang-docsUpgrade delve-debuginfoUpgrade delveUpgrade go-toolsetUpgrade delve-debugsourceUpgrade golang-raceUpgrade golang-srcNo solution existsUpgrade golangUpgrade golang-testsUpgrade golang-binUpgrade golang-misc | Sep 22, 2021 | Aug 7, 2021 |
| Rocky_linux | — | Upgrade golangUpgrade golang-raceUpgrade go-toolsetUpgrade delve-debuginfoUpgrade golang-binUpgrade delveUpgrade delve-debugsource | Mar 12, 2024 | Aug 7, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 7, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub