5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.1 High
AI Score
Confidence
High
0.007 Low
EPSS
Percentile
80.5%
Debian LTS Advisory DLA-2892-1 [email protected]
https://www.debian.org/lts/security/ Sylvain Beucler
January 21, 2022 https://wiki.debian.org/LTS
Package : golang-1.7
Version : 1.7.4-2+deb9u4
CVE ID : CVE-2021-33196 CVE-2021-36221 CVE-2021-39293 CVE-2021-41771
CVE-2021-44716 CVE-2021-44717
Debian Bug : 989492 991961
Several vulnerabilities were discovered in the Go programming
language. An attacker could trigger a denial-of-service (DoS) and
information leak.
CVE-2021-33196
In archive/zip, a crafted file count (in an archive's header) can
cause a NewReader or OpenReader panic.
CVE-2021-36221
Go has a race condition that can lead to a net/http/httputil
ReverseProxy panic upon an ErrAbortHandler abort.
CVE-2021-39293
Follow-up fix to CVE-2021-33196
CVE-2021-41771
ImportedSymbols in debug/macho (for Open or OpenFat) accesses a
Memory Location After the End of a Buffer, aka an out-of-bounds
slice situation.
CVE-2021-44716
net/http allows uncontrolled memory consumption in the header
canonicalization cache via HTTP/2 requests.
CVE-2021-44717
Go on UNIX allows write operations to an unintended file or
unintended network connection as a consequence of erroneous
closing of file descriptor 0 after file-descriptor exhaustion.
For Debian 9 stretch, these problems have been fixed in version
1.7.4-2+deb9u4.
We recommend that you upgrade your golang-1.7 packages.
For the detailed security status of golang-1.7 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/golang-1.7
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 10 | amd64 | golang-1.11-src | < 1.11.6-1+deb10u6 | golang-1.11-src_1.11.6-1+deb10u6_amd64.deb |
Debian | 9 | armel | golang-1.7-go | < 1.7.4-2+deb9u4 | golang-1.7-go_1.7.4-2+deb9u4_armel.deb |
Debian | 9 | all | golang-1.8-doc | < 1.8.1-1+deb9u4 | golang-1.8-doc_1.8.1-1+deb9u4_all.deb |
Debian | 11 | ppc64el | golang-1.15-go-dbgsym | < 1.15.15-1~deb11u2 | golang-1.15-go-dbgsym_1.15.15-1~deb11u2_ppc64el.deb |
Debian | 10 | i386 | golang-1.11-src | < 1.11.6-1+deb10u6 | golang-1.11-src_1.11.6-1+deb10u6_i386.deb |
Debian | 11 | mipsel | golang-1.15-go-dbgsym | < 1.15.15-1~deb11u2 | golang-1.15-go-dbgsym_1.15.15-1~deb11u2_mipsel.deb |
Debian | 11 | armel | golang-1.15-go | < 1.15.15-1~deb11u2 | golang-1.15-go_1.15.15-1~deb11u2_armel.deb |
Debian | 9 | arm64 | golang-1.8-go | < 1.8.1-1+deb9u4 | golang-1.8-go_1.8.1-1+deb9u4_arm64.deb |
Debian | 10 | all | golang-1.11 | < 1.11.6-1+deb10u6 | golang-1.11_1.11.6-1+deb10u6_all.deb |
Debian | 9 | amd64 | golang-1.7-src | < 1.7.4-2+deb9u4 | golang-1.7-src_1.7.4-2+deb9u4_amd64.deb |
5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.1 High
AI Score
Confidence
High
0.007 Low
EPSS
Percentile
80.5%