CVE-2021-33196 Denial of service in n/a

High 7.5 Published 2 Aug 2021 Updated 3 Aug 2024

A crafted zip archive header causes a panic in Go's archive/zip package, leading to denial of service for applications using the library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-33196?

CVE-2021-33196 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 2 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.

Weakness: CWE-20

Which versions are affected by CVE-2021-33196?

2 open source packages ship an affected version, including golang and stdlib. It affects 2 products.

Package	Affected	Fixed in
`golang` Bitnami	All versions	`1.15.13, 1.16.5`
`stdlib` Go	All versions	`1.15.13, 1.16.5`

Linux distribution packages (11)

`go-toolset-1.15` Red Hat:devtools:2021	All versions	`0:1.15.13-1.el7_9`
`go-toolset-1.15-build` Red Hat:devtools:2021	All versions	`0:1.15.13-1.el7_9`
`go-toolset-1.15-golang` Red Hat:devtools:2021	All versions	`0:1.15.13-1.el7_9`
`go-toolset-1.15-golang-bin` Red Hat:devtools:2021	All versions	`0:1.15.13-1.el7_9`
`go-toolset-1.15-golang-docs` Red Hat:devtools:2021	All versions	`0:1.15.13-1.el7_9`
`go-toolset-1.15-golang-misc` Red Hat:devtools:2021	All versions	`0:1.15.13-1.el7_9`
`go-toolset-1.15-golang-race` Red Hat:devtools:2021	All versions	`0:1.15.13-1.el7_9`
`go-toolset-1.15-golang-src` Red Hat:devtools:2021	All versions	`0:1.15.13-1.el7_9`
`go-toolset-1.15-golang-tests` Red Hat:devtools:2021	All versions	`0:1.15.13-1.el7_9`
`go-toolset-1.15-runtime` Red Hat:devtools:2021	All versions	`0:1.15.13-1.el7_9`
`go-toolset-1.15-scldevel` Red Hat:devtools:2021	All versions	`0:1.15.13-1.el7_9`

Products include Debian Debian Linux, Golang Go.

How do I fix CVE-2021-33196?

Upgrade golang to a fixed version for your release line: 1.15.13 or 1.16.5.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-33196 being exploited?

There is no known exploitation of CVE-2021-33196 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as AZL-79084, AZL-98919, BIT-golang-2021-33196, DEBIAN-CVE-2021-33196, GHSA-6r28-26q2-vxwj, GO-2021-0240 and 2 more.