CVE-2021-36221

 

Published at: - 08-08-2021 08:15

Last modified: - 14-09-2022 11:11

Total changes: - 14

Description

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

 

Verification logic

 

Reference

• https://groups.google.com/g/golang-announce/c/JvWG9FUUYT0
• https://groups.google.com/forum/#!forum/golang-announce
• https://groups.google.com/g/golang-announce/c/uHACNfXAZqk
• FEDORA-2021-38b51d9fd3-Mailing List, Third Party Advisory
• FEDORA-2021-6a3024b3fd-Mailing List, Third Party Advisory
• FEDORA-2021-e71b05ba7b-Mailing List, Third Party Advisory
• [debian-lts-announce] 20220121 [SECURITY] [DLA 2892-1] golang-1.7 security update-Mailing List, Third Party Advisory
• [debian-lts-announce] 20220121 [SECURITY] [DLA 2891-1] golang-1.8 security update-Mailing List, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
• GLSA-202208-02-Third Party Advisory

 

Keywords

NVD

 

CVE-2021-36221

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures