Cyber Resilience

CVE-2021-29923

HighPublic PoC

Published: 07 August 2021

Published
07 August 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0025 49.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-29923 is a high-severity an unspecified weakness vulnerability in Golang Go. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 49.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This…

more

affects net.ParseIP and net.ParseCIDR.

CWE(s)
NVD-CWE-noinfo

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

golang
go
≤ 1.17
oracle
timesten in-memory database
≤ 21.1.1.1.0
fedoraproject
fedora
36

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References