The vulnerability of the net.Lookup{Addr,CNAME,Host} functions in the Golang programming language allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

🗓️ 05 Apr 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 7 Views

Go net.Lookup functions lack DNS hostname filtering, enabling remote attackers to access data.

Reporter	Title	Published	Views	Family All 194
IBM Security Bulletins	Security Bulletin: Operations Dashboard is vulnerable to multiple Go vulnerabilities	14 Oct 202113:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container could allow a remote attacker to execute arbitrary code due to CVE-2021-33195	3 Aug 202115:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go	1 Oct 202106:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Integration is vulnerable to multiple Go vulnerabilities	15 Oct 202113:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams affected by multiple vulnerabilities in Golang	21 Dec 202117:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring has multiple vulnerabilities associated with the Go runtime (CVE-2021-29923, CVE-2021-31525, CVE-2021-33194, CVE-2021-33195, CVE-2021-33196, CVE-2021-33197, CVE-2021-33198)	21 Jul 202212:35	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Golang Go may affect IBM Spectrum Protect Server (CVE-2021-33195, CVE-2021-33197, CVE-2021-36221)	10 Dec 202115:45	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.6 contains fixes for multiple security vulnerabilities.	25 Oct 202213:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Insights is affected by multiple vulnerabilities	25 Jan 202219:15	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Redis, OpenSSH, Golang Go, and Apache Kafka may affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and OpenShift	10 Dec 202121:55	–	ibm

Vulners

Node

OR

go goRange<1.15.13

go goRange1.16.0–1.16.5

Source	Link
github	www.github.com/golang/go/commit/31d60cda1f58b7558fc5725d2b9e4531655d980e
github	www.github.com/golang/go/issues/46241
groups	www.groups.google.com/g/golang-announce/c/RgCMkAEQjSI
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-33195
security-tracker	www.security-tracker.debian.org/tracker/CVE-2021-33195
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.9/
altsp	www.altsp.su/obnovleniya-bezopasnosti/
web	www.web.nvd.nist.gov/view/vuln/detail

16 Sep 2024 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 37.3

CVSS 27.5

EPSS0.03231

Go net lookup DNS hostname filtering remote attackers data exposure service failures