Vulnerability CVE-2021-36221: Information
Description
Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
Severity: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| golang | sisyphus | 1.16-alt1 | 1.22.4-alt1 | ALT-PU-2021-1376-1 | 266604 | Fixed |
| golang | p10 | 1.16.7-alt1 | 1.21.11-alt1 | ALT-PU-2021-2502-1 | 282290 | Fixed |
| golang | p9 | 1.15.15-alt1 | 1.15.15-alt1 | ALT-PU-2021-2489-1 | 282289 | Fixed |
| golang | c10f1 | 1.16.7-alt1 | 1.21.10-alt1 | ALT-PU-2021-2502-1 | 282290 | Fixed |
| golang | c9f2 | 1.16.13-alt1.c9 | 1.20.13-alt1 | ALT-PU-2022-1243-1 | 293762 | Fixed |
| golang | p11 | 1.16-alt1 | 1.22.4-alt1 | ALT-PU-2021-1376-1 | 266604 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| https://groups.google.com/g/golang-announce/c/JvWG9FUUYT0 |
|
| https://groups.google.com/g/golang-announce/c/uHACNfXAZqk |
|
| [debian-lts-announce] 20220121 [SECURITY] [DLA 2892-1] golang-1.7 security update |
|
| [debian-lts-announce] 20220121 [SECURITY] [DLA 2891-1] golang-1.8 security update |
|
| https://www.oracle.com/security-alerts/cpujan2022.html |
|
| https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf |
|
| GLSA-202208-02 |
|
| [debian-lts-announce] 20230419 [SECURITY] [DLA 3395-1] golang-1.11 security update | |
| https://groups.google.com/forum/#%21forum/golang-announce | |
| FEDORA-2021-38b51d9fd3 | |
| FEDORA-2021-6a3024b3fd | |
| FEDORA-2021-e71b05ba7b |