Read the docs
TI-2021-10545 Aliases CVE-2021-29923GHSA-38h6-vxp4-qxvm

Go before 1.17 does not properly consider extraneous zero characters at the beginning of…

Priority LOW 39Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 17 fixed, 19 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

Why it matters now

EPSS 0.03744 89th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial Red Hat: 23 advisoriesRed Hat: 17 fixed, 19 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.17VulnerableGo standard library
cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:*before 21.1.1.1.0VulnerableOracle
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.17 Vulnerable ·Go standard library
  • cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:* Versions before 21.1.1.1.0 Vulnerable ·Oracle
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject

Remediation

Red Hat 23 advisories

  • RHSA-2022:1372 Released 2022-04-13 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.10.0 enhancement, security & bug fix update
    • RHODF 4.10 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-operator-bundle +21
  • RHSA-2022:1276 Released 2022-04-07 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 2.0.9 security update
    • OpenShift Service Mesh 2.0 kiali-v1.24.7.redhat1-1.el8, servicemesh-2.0.9-3.el8, servicemesh-istioctl-2.0.9-3.el8 +6
  • RHSA-2022:0577 Released 2022-03-28 · Red Hat rating Moderate
    Windows Container Support for Red Hat OpenShift 5.0.0 [security update]
    • Red Hat OpenShift Container Platform 4.10 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel8-operator
Show 20 more Red Hat advisories
  • RHSA-2022:0988 Released 2022-03-24 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.1 (golang-github-vbatts-tar-split) security update
    • Red Hat OpenStack Platform 16.1 golang-github-vbatts-tar-split-0.11.1-6.el8ost
  • RHSA-2022:0989 Released 2022-03-24 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.1 (golang-qpid-apache) security update
    • Red Hat OpenStack Platform 16.1 golang-qpid-apache-0.32.0-rc1.9.el8ost
  • RHSA-2022:0998 Released 2022-03-23 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.2 (golang-github-vbatts-tar-split) security update
    • Red Hat OpenStack Platform 16.2 golang-github-vbatts-tar-split-0.11.1-6.el8ost
  • RHSA-2022:0997 Released 2022-03-23 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.2 (golang-qpid-apache) security update
    • Red Hat OpenStack Platform 16.2 golang-qpid-apache-0.32.0-rc1.9.el8ost
  • RHSA-2022:0947 Released 2022-03-16 · Red Hat rating Moderate
    OpenShift Virtualization 4.10.0 Images security and bug fix update
    • CNV 4.10 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8
  • RHSA-2022:0561 Released 2022-02-23 · Red Hat rating Moderate
    OpenShift Container Platform 4.9.22 security update
    • Red Hat OpenShift Container Platform 4.9 openshift4/egress-router-cni-alt-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
  • RHSA-2022:0557 Released 2022-02-23 · Red Hat rating Moderate
    OpenShift Container Platform 4.9.22 security update
    • Red Hat OpenShift Container Platform 4.9 butane-0.13.1-2.rhaos4.9.el8, butane-redistributable-0.13.1-2.rhaos4.9.el8, cri-o-1.22.1-17.rhaos4.9.git3029b1d.2.el8 +14
  • RHSA-2022:0434 Released 2022-02-03 · Red Hat rating Moderate
    Release of OpenShift Serverless 1.20.0
    • Red Hat OpenShift Serverless 1.20 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +31
  • RHSA-2022:0432 Released 2022-02-03 · Red Hat rating Moderate
    Release of OpenShift Serverless Client kn 1.20.0
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-0.26.0-2.el8
  • RHSA-2022:0431 Released 2022-02-03 · Red Hat rating Moderate
    Red Hat Advanced Cluster Security 3.68 security and enhancement update
    • RHACS 3.68 for RHEL 8 advanced-cluster-security/rhacs-scanner-rhel8
  • RHSA-2022:0318 Released 2022-01-27 · Red Hat rating Moderate
    Red Hat OpenShift distributed tracing 2.1.0 security update
    • Red Hat OpenShift distributed tracing 2.1 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +9
  • RHSA-2022:0260 Released 2022-01-25 · Red Hat rating Important
    Red Hat OpenStack Platform 16.1 (etcd) security update
    • Red Hat OpenStack Platform 16.1 etcd-3.3.23-7.el8ost
  • RHSA-2022:0237 Released 2022-01-24 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2 (etcd) security update
    • Red Hat OpenStack Platform 16.2 etcd-3.3.23-7.el8ost
  • RHSA-2021:4914 Released 2021-12-02 · Red Hat rating Moderate
    OpenShift Virtualization 4.8.3 Images security and bug fix update
    • CNV 4.8 for RHEL 8 container-native-virtualization/vm-import-operator-rhel8
  • RHSA-2021:4910 Released 2021-12-02 · Red Hat rating Moderate
    OpenShift Virtualization 4.8.3 RPMs security and bug fix update
    • CNV 4.8 for RHEL 7 kubevirt-4.8.3-251.el7, kubevirt-virtctl-4.8.3-251.el7, kubevirt-virtctl-redistributable-4.8.3-251.el7
    • CNV 4.8 for RHEL 8 kubevirt-4.8.3-251.el8, kubevirt-virtctl-4.8.3-251.el8, kubevirt-virtctl-redistributable-4.8.3-251.el8
  • RHSA-2021:4902 Released 2021-12-01 · Red Hat rating Moderate
    ACS 3.67 security and enhancement update
    • RHACS 3.67 for RHEL 8 advanced-cluster-security/rhacs-rhel8-operator
  • RHSA-2021:4725 Released 2021-11-17 · Red Hat rating Moderate
    OpenShift Virtualization 2.6.8 Images security and bug fix update
    • CNV 2.6 for RHEL 8 container-native-virtualization/kubevirt-cpu-model-nfd-plugin, container-native-virtualization/kubevirt-cpu-node-labeller, container-native-virtualization/kubevirt-kvm-info-nfd-plugin +2
  • RHSA-2021:4722 Released 2021-11-17 · Red Hat rating Moderate
    OpenShift Virtualization 2.6.8 RPMs security and bug fix update
    • CNV 2.6 for RHEL 7 kubevirt-2.6.8-211.el7, kubevirt-virtctl-2.6.8-211.el7, kubevirt-virtctl-redistributable-2.6.8-211.el7
    • CNV 2.6 for RHEL 8 kubevirt-2.6.8-211.el8, kubevirt-virtctl-2.6.8-211.el8, kubevirt-virtctl-redistributable-2.6.8-211.el8
  • RHSA-2021:3585 Released 2021-09-21 · Red Hat rating Moderate
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-2.module+el8.4.0+12542+e3fec473.aarch64::go-toolset:rhel8 +18
  • RHSA-2021:3431 Released 2021-09-07 · Red Hat rating Moderate
    go-toolset-1.15-golang security update
    • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.15-golang-1.15.14-2.el7_9, go-toolset-1.15-golang-bin-1.15.14-2.el7_9, go-toolset-1.15-golang-docs-1.15.14-2.el7_9 +4
    • Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.15-golang-1.15.14-2.el7_9, go-toolset-1.15-golang-bin-1.15.14-2.el7_9, go-toolset-1.15-golang-docs-1.15.14-2.el7_9 +4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for ContainersAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
OpenShift Service Mesh 2.0AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 4AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform Assisted Installer 1AffectedNo fix yet
Red Hat OpenShift Virtualization 2AffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Openshift Container Storage 4AffectedNo fix yet
Red Hat Openshift Sandboxed ContainersAffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Will not fix
CNV 2.6 for RHEL 7Fixed RHSA-2021:4722
CNV 2.6 for RHEL 8Fixed RHSA-2021:4722, RHSA-2021:4725
CNV 4.8 for RHEL 7Fixed RHSA-2021:4910
CNV 4.8 for RHEL 8Fixed RHSA-2021:4910
OpenShift Service Mesh 2.0Fixed RHSA-2022:1276
RHACS 3.67 for RHEL 8Fixed RHSA-2021:4902
RHACS 3.68 for RHEL 8Fixed RHSA-2022:0431
RHODF 4.10 for RHEL 8Fixed RHSA-2022:1372
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:3431
Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:3431
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:3585
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2022:0577
Red Hat OpenShift Container Platform 4.9Fixed RHSA-2022:0557, RHSA-2022:0561
Red Hat OpenShift Serverless 1.0Fixed RHSA-2022:0432
Red Hat OpenShift Serverless 1.20Fixed RHSA-2022:0434
Red Hat OpenStack Platform 16.1Fixed RHSA-2022:0260, RHSA-2022:0988, RHSA-2022:0989
Red Hat OpenStack Platform 16.2Fixed RHSA-2022:0237, RHSA-2022:0997, RHSA-2022:0998
Not affected: 14 products
  • CNV 2.6 for RHEL 8
  • OpenShift Service Mesh 2.0
  • RHACS 3.67 for RHEL 8
  • RHACS 3.68 for RHEL 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.9
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift distributed tracing 2
  • Red Hat OpenStack Platform 16.1
  • Red Hat OpenStack Platform 16.2
  • Red Hat Openshift Container Storage 4
  • Service Telemetry Framework 1.2 for RHEL 8
  • Service Telemetry Framework 1.3 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-29923
  2. 2026-10-03 Alias added: GHSA-38h6-vxp4-qxvm

References

Exploit 2

Patch 2

Advisory 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences