Ubuntu.comUB:CVE-2021-44716CVE-2021-44716
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.7 High
AI Score
Confidence
High
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
58.4%
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled
memory consumption in the header canonicalization cache via HTTP/2
requests.
Bugs
Notes
| Author | Note |
|---|---|
| alexmurray | google-guest-agent contains a vendored copy of golang-golang-x-net |
| mdeslaur | google-guest-agent doesn’t start a http server except in tests |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 22.04 | noarch | golang-1.17 | < any | UNKNOWN |
| ubuntu | 18.04 | noarch | golang-1.8 | < any | UNKNOWN |
| ubuntu | 18.04 | noarch | golang-golang-x-net-dev | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | golang-golang-x-net-dev | < any | UNKNOWN |
| ubuntu | 16.04 | noarch | golang-golang-x-net-dev | < any | UNKNOWN |
| ubuntu | 18.04 | noarch | google-guest-agent | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | google-guest-agent | < 20231004.02-0ubuntu1~20.04.3 | UNKNOWN |
| ubuntu | 22.04 | noarch | google-guest-agent | < 20231004.02-0ubuntu1~22.04.3 | UNKNOWN |
| ubuntu | 23.10 | noarch | google-guest-agent | < 20230426.00-0ubuntu2 | UNKNOWN |
| ubuntu | 16.04 | noarch | google-guest-agent | < any | UNKNOWN |
References
github.com/golang/go/commit/48d948963c5ce7add72af5665a871caff6c1d35a (go1.17.5)
github.com/golang/net/commit/491a49abca63de5e07ef554052d180a1b5fe2d70
groups.google.com/g/golang-announce/c/hcmEScgc00k/m/ZWnOjeY4CQAJ
launchpad.net/bugs/cve/CVE-2021-44716
nvd.nist.gov/vuln/detail/CVE-2021-44716
security-tracker.debian.org/tracker/CVE-2021-44716
www.cve.org/CVERecord?id=CVE-2021-44716
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.7 High
AI Score
Confidence
High
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
58.4%