Red Hat Security AdvisoryRHSA-2021:3431
go-toolset-1.15-golang security update
Released 2021-09-07 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.15-golang-1.15.14-2.el7_9, go-toolset-1.15-golang-bin-1.15.14-2.el7_9, go-toolset-1.15-golang-docs-1.15.14-2.el7_9 +4
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.15-golang-1.15.14-2.el7_9, go-toolset-1.15-golang-bin-1.15.14-2.el7_9, go-toolset-1.15-golang-docs-1.15.14-2.el7_9 +4
Fixes 3 records
Priority LOW 39
Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03744 · Published 2021-08-07 · Partial fix
Priority LOW 38
Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC…
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.03204 · Published 2021-08-02 · Partial fix CWE-74
Priority LOW 28
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0226 · Published 2021-08-02 · Partial fix CWE-862
