CVE-2021-36221 Race condition in n/a
A race condition in the Go ReverseProxy can cause a panic, leading to denial of service for applications using this component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-36221?
CVE-2021-36221 is a medium-severity vulnerability in Debian Debian Linux, published on 8 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
Weakness: CWE-362
Which versions are affected by CVE-2021-36221?
2 open source packages ship an affected version, including golang and stdlib. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.15.15, 1.16.7 |
stdlib Go | All versions | 1.15.15, 1.16.7 |
Linux distribution packages (18)
openshift-serverless-clients Red Hat:serverless:1.0::el8 | All versions | 0:0.25.1-1.el8 |
go1.15 SUSE:Enterprise Storage 6 | All versions | 1.15.15-1.39.1 |
go1.15 SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 1.15.15-1.39.1 |
go1.15 SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 1.15.15-1.39.1 |
go1.15 SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 1.15.15-1.39.1 |
go1.16 SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 1.16.7-1.23.1 |
go1.15 SUSE:Linux Enterprise Module for Development Tools 15 SP3 | All versions | 1.15.15-1.39.1 |
go1.16 SUSE:Linux Enterprise Module for Development Tools 15 SP3 | All versions | 1.16.7-1.23.1 |
go1.15 SUSE:Linux Enterprise Server 15 SP1-BCL | All versions | 1.15.15-1.39.1 |
go1.15 SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 1.15.15-1.39.1 |
go1.15 SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 1.15.15-1.39.1 |
go1.15 SUSE:Manager Proxy 4.0 | All versions | 1.15.15-1.39.1 |
go1.15 SUSE:Manager Retail Branch Server 4.0 | All versions | 1.15.15-1.39.1 |
go1.15 SUSE:Manager Server 4.0 | All versions | 1.15.15-1.39.1 |
go1.15 openSUSE:Leap 15.2 | All versions | 1.15.15-lp152.26.1 |
go1.16 openSUSE:Leap 15.2 | All versions | 1.16.7-lp152.8.1 |
go1.15 openSUSE:Leap 15.3 | All versions | 1.15.15-1.39.1 |
go1.16 openSUSE:Leap 15.3 | All versions | 1.16.7-1.23.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Golang Go, Oracle Timesten In-Memory Database, Siemens Scalance Lpe9403 Firmware.
How do I fix CVE-2021-36221?
Upgrade golang to a fixed version for your release line: 1.15.15 or 1.16.7.
Is CVE-2021-36221 being exploited?
There is no known exploitation of CVE-2021-36221 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-golang-2021-36221, DEBIAN-CVE-2021-36221, GHSA-6qcx-qr4g-4fx9, GO-2021-0245, MGASA-2021-0416, RHSA-2021:4765 and 7 more.